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IN THE UNITED STATES DISTRICT COURT 
FOR THE SOUTHERN DISTRICT OF FLORIDA 
WEST PALM BEACH DIVISION 
CASE NO. 9:18-cv—-80176-BB 


IRA KLEIMAN, as the personal representative 
of the Estate of David Kleiman, and W&K Info 
Defense Research, LLC, 


Plaintiffs, November 16, 2021 
10:04 a.m. 
vs. 


CRAIG WRIGHT, 


Defendant. Pages 1 THROUGH 244 


TRANSCRIPT OF TRIAL DAY 10 
BEFORE THE HONORABLE BETH BLOOM 
UNITED STATES DISTRICT JUDGE 
And a Jury of 10 


Appearances: 
FOR THE PLAINTIFF: ROCHE FREEDMAN, LLP 
DEVIN FREEDMAN, ESQ. 
KYLE ROCHE, ESQ. 
200 South Biscayne, Suite 5500 
Miami, Florida 33131 


BOIES SCHILLER & FLEXNER 

ANDREW BRENNER, ESQ. 

STEPHEN N. ZACK, ESQ. 

100 Southeast 2nd Street, Suite 2800 
Miami, Florida 33131 


FOR THE DEFENDANT: RIVERO MESTRE, LLP 
ANDRES RIVERO, ESQ. 
JORGE MESTRE, ESQ. 
AMANDA M. MCGOVERN, ESQ. 
ZALMAN KASS, ESQ. 
MICHAEL A. FERNANDEZ, ESQ. 
2525 Ponce de Leon Boulevard, Suite 1000 
Coral Gables, Florida 33134 


COURT REPORTER: Yvette Hernandez 
U.S. District Court 
400 North Miami Avenue, Room 10-2 
Miami, Florida 33128 
yvette_hernandez@flsd.uscourts.gov 
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order of the Court, 10:04 a.m.) 


COURT: Good morning to everyone. Go ahead and 


have a seat. 
How is everyone this morning? 
MR. RIVERO: Good morning, Judge. 


THE COURT: Are there items that we can address at 


this time? 


MR. BRENNER: Judge, one for the Plaintiffs regarding 


the excuse me regarding the request for judicial notice. 


We have met and conferred. I know that Mr. Rivero has an issue 


that may be more time-sensitive because it has to do with 
Dr. Edman, but happy to do both or either, whatever Your 
Honor's pleasure. 


MR. RIVERO: Your Honor, our issue actually relates 


directly to the testimony of Dr. Edman and the use of the word 


forgery," Your Honor, and I have a motion to make in that 
regard. 
THE COURT: Why don't you make your motion now, sir. 


MR. RIVERO: Yes. Judge, this is an issue that's been 


considered both by you and by Judge Reinhart. The specific 


motion I'm making is both for the exclusion of further use of 


the word "forgery" in Edman's testimony and also for an 


instruction as to its use yesterday. And the analysis is very 


simple, Judge. It's a 401/403 balancing. 


Edman testified -- specifically the Court found this 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 54 of 234 


and Judge Reinhart's also found this, that the word -- for him 


the word "forgery," he uses it interchangeably with "altered," 


"modified" or "manipulated." So therefore, Judge, on the 401 


aspect of this balancing, using the word "forgery" adds 


absolutely nothing on that side of the balance because there 


are three other choices. So when we are talking about 


relevance, Judge, obviously the relevance of an expert's 


testimony is to help the jury understand what's going on. It 


doesn't add on that side by his own testimony, and by a finding 


of this Court, and by a finding of Judge Reinhart. 


On the other hand, Judge, both this Court and Judge 


Reinhart have found that the use of the word "forgery" could 


— 


be -—- this Court said could be confusing. Judge Reinhart 


actually said something different. He said it was, in fact, 


incorrect use of the term but he, as a fine lawyer and smart 


_ 


judge, and the fact finder in that hearing, would be able to 


distinguish and, therefore, he would permit its use. 


The difference here is, Judge -- and I woke up in the 


middle of the night thinking about this -- I looked up forgery 


in the Merriam-Webster Dictionary, Your Honor, and also in the 


Oxford Dictionary. In both the denotation and the connotation 


of that word, in English, bears an intent to defraud. That's 


what he's been barred from doing, and he says he's not offering 


an opinion about the intent behind whatever change was made to 


these documents. 
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However, Judge, the problem is the word "forgery" 


inevitably and inherently, not potentially, confusing, means 


that someone is acting with a fraudulent intent. The Court has 


— 


not permitted him to say fraud. By allowing forgery, Judge, 


now where there's no additional evidence, no additional value 


on the 401 side, this 403 side, Judge, pops way up. The 


balance is completely out of whack. 


THE COURT: All right. Mr. Rivero, since this is the 


first time that this is being brought to the Court's attention, 


what is the suggested description that you're asking for the 
Plaintiffs to use? 


MR. RIVERO: Judge, they have themselves -- Dr. Edman 


has testified there are thr words that are equivalent: 
"alteration," "modification," "manipulation." We have no 


objection because all three are clean in both denotation -- 


connotation may be different, Judge, and we understand 


manipulation is different from modification, but those we 


accept, that there's -- you know, there's planning. 


Forgery's not that situation, Judge. So my request is 


very specific: Instruction on the previous use of "forgery," 


that it does not bear -—- he's not testifying about fraudulent 


intent, and banning the use of "forgery" going forward. That's 
our request. 
MR. ROCHE: Your Honor, may I respond? 


THE COURT: Yes, of course. 
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MR. ROCHE: Mr. Rivero says he woke up in the middle 


of the night concerned about the use of the word "forgery." It 


was in the expert reports that Dr. Edman submitted over a year 
and a half ago. That's point one. 


Point two, Mr. Rivero was free to object to its use in 


front of the jury yesterday. He did not. 


Third, finally, even if those two things weren't true, 


this goes to the weight of Dr. Edman's testimony. Mr. Rivero 


is free to cross him on this. And I understand that there's an 


expert, Mr. Chambers, who is also going to be put up during 
their case to rebut the weight of Dr. Edman's opinions. 


THE COURT: And is that expert going to say it's not a 


forgery? 


MR. ROCHE: I don't -—- that's a question | 
Mr. Rivero. 


MR. RIVERO: Your Honor, he will be explaining that 


that -- yeah, forgery for sure, Judge, because no one in this 


case can give evidence that there's a fraudulent intent, 


including Edman. He's admitted that. 


Given that he's admitted that he cannot testify about 


fraud, given that forgery includes in the dictionary definition 
an intent to defraud, it's plain, Judge -- the 403 balance. 
This was raised with Judge Reinhart. It was raised with the 
Court. The Court said it was confusing and so now they have 


made it a central feature. 
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They just did forgery number one, Judge. They're 


going to talk about forgery number two, forgery number three. 


There are 50 examples. This is really a 403 problem and it 


shouldn't be permitted, Judge. 
MR. ROCHE: Your Honor, we're not going to go through 


all 50. TI promise you that. But there's another point. We 


_ 


front of the jury yesterday. 


have used the word "forgery" in 


To the extent and Mr. Rivero could have objected yesterday 


to that. To the extent we're now getting an instruction that 


we have to remove that word, I do think that undercuts and 


unfairly prejudices Dr. Edman and Plaintiffs' presentation. 


THE COURT: All right. Is there anything further? 


MR. ROCHE: No, Your Honor. 


THE COURT: All right. Anything further, Mr. Rivero? 


MR. RIVERO: No, Your Honor. 


THE COURT: All right. Let me state that the 


Defendants -—- or the Defendant had access to the report, knew 


that that was going to be Dr. Edman's testimony. Whether the 


description is a forgery, a fake, counterfeit, phony, sham, 


whatever the description is, the testimony is that it was 


certainly altered, modified, and manipulated. So I think we're 


mincing words. And I don't believe that the use of "forgery" 


or "counterfeit" connotes anything other than it supports the 
testimony that that was his finding. 


You're free to cross-examine, but I'm certainly not 
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going to instruct the jury with regard to a use of a word that 


is certainly part of the opinion that it is a counterfeit, it 


is fake, it is not the true email or document. And I don't 


believe that there's any instruction that needs to be given. 


With regard to the request for judicial notice, is 


there an objection on the part of the Defendant? 


MR. FERNANDEZ: Good morning, Your Honor. 


So with respect to the request for judicial notice, we 


object on the grounds that Plaintiffs did not and could not lay 


out a proper foundation for a conclusion that the dates 


demanded in their judicial notice are relevant to purportedly 


valuing any of the IP in question. 


And further, Your Honor, to the extent that it is 


coming in through judicial notice, it is suggesting to the jury 


relevant dates for damages. So we believe that that would be 
an improper -—-— 


THE COURT: Well, I'm asking with regard to judicial 


notice. And my question would be that if, in fact, the 


applicable currency exchange rate cannot be determined through 
these sources, what other sources are you stating should be 
used? 


MR. FERNANDEZ: Your Honor, the objection's not to the 


sources themselves but to the use of the judicial notice in 


order to get this information in front of the jury. I believe 


that it should have been done through expert testimony 
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testifying about proper valuation and laying a foundation f 


_ 


the relevance of that information. 


Here, our concern is that basically by using judicial 


notice, it is suggesting to the jury that those are relevant 


dates for damages. And it's coming with the imprimatur of the 
Court. 

THE COURT: So with regard to the determination as to 
whether a fact or facts in this case can be explained to the 


Court by the Court taking judicial notice, the question is 


whether these are facts that are not subject to reasonable 


dispute. Are these facts subject to reasonable dispute? 
MR. FERNANDEZ: The underlying exchange rates and 


the -- on those particular dates are not subject to dispute, 


Your Honor. The issue that we dispute is the use of the 


judicial notice mechanism to get information about the exchange 


rates on those dates in front of the jury. Because as I noted, 


I believe it improperly primes the jury to find that those are 


relevant dates. 


THE COURT: Well, isn't this information on an 


Fficial government website? So is it subject to any dispute? 


MR. FERNANDEZ: No, Your Honor. The information 


itself is not subject to dispute. It's just the use of the 


judicial notice mechanism with which we're concerned. 


THE COURT: But do you believe that this is proper for 


the Court to take judicial notice, that is there is no dispute? 
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MR. FERNANDEZ: Well, with respect to the underlying 


information itself, no. But with respect to the relevance of 


those dates, and with respect to the information and the 


purpose for which it's being used, we do object, Your Honor, 


that it's a contested issue as to whether it's even relevant -- 


that those dates ar ven relevant for purposes of calculating 
damages. 


THE COURT: You don't believe that that information is 


relevant to this lawsuit? 


MR. FERNANDEZ: Not to the valuation of the 


intellectual property, Your Honor. We don't believe that it's 


relevant because those are dates that -- for which relevance 


hasn't been established by the Plaintiffs. 
THE COURT: A response? 
MR. BRENNER: Good morning, Your Honor. 


I think Your Honor seized on the right question, that 


the question before the Court at this point excuse me is: 


Are these facts that are reasonably in dispute? I think that 


you've heard it from both sides that these are not reasonably 


disputable facts. 


I think our motion lays out -- but the dates are used 


because they're the valuation dates in evidence of the 


intellectual property. There's three different dates. They're 


from documents that have already been received in evidence. So 


I'm not sure what the relevance argument is, but they're 
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clearly pegged to those dates. 
What I understand the concern to be -—- and maybe I'm 


misunderstanding it -- they don't want the Court to put your 


finger on the scale and sort of say these -- you know, I think 


we can work that out in the jury instruction process, but as 


far as whether these are facts in dispute and subject to 


judicial notice, I think at this point that's not really 


contested. 


THE COURT: All right. Is there anything further? 


Because it does appear that the Eleventh Circuit has allowed 


the Court to take judicial notice of historical exchange rates. 


I'm -- I think what your concern is, is that an expert may 
testify to it. You would have no objection to the expert, but 


you would have some concern about the Court letting the jury 


know that the Court instructs you that the exchange rate on 


April 2nd, 2014 was "X." That's what the concern is? 


MR. FERNANDEZ: Yes, Your Honor. That's the concern, 


that the Court is telling the jury that these are the relevant 


exchange rates on those dates and, therefore, that the jury 


believes that those dates are relevant for purposes of 


determining damages calculations. 


And as I noted, Your Honor, the actual relevance of 
those dates for purposes of evaluating damages has not been 
established in Plaintiffs' claim. 


THE COURT: All right. Why don't you prepare an 
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instruction and the Court will take judicial notice, because it 


doesn't appear that those dates and certainly the amount is in 
dispute. 


MR. BRENNER: Thank you, Judge. 


THE COURT: Okay. All right. If there's nothing 


further, then let's bring in the jury. And I'm sorry. Where 
is Dr. Edman? 


Come on forward, sir. 


MS. McGOVERN: Your Honor, could I must mention one 


scheduling thing for the Court? 


THE COURT: Yes, of course. 


MS. McGOVERN: We have a witness that we are going to 


be calling remotely, and we just want to make sure that we're 
not advising the Court without enough time to set that up. 


Mr. Kuharcik had requested, because he has a 


90-year-old mother, that he would like to testify remotel 


we are going to be presenting that remotely. And we woul 
to be able to do that on Friday. 

THE COURT: On Friday. 

All right. And did you advise Liz, so Liz is aware? 


MS. McGOVERN: I thought I would just approach the 


THE COURT: And is this via Zoom? So you want the 


Court to set that up? 


MS. McGOVERN: Yes. 
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THE COURT: What time on Friday? 


MS. McGOVERN: We're not sure if a witness will roll 


over from Thursday to Friday. So Mr. Kuharcik is available to 


be flexible in that regard, but we're hoping that it would be 


in the morning on Friday at 10:00 a.m. 


THE COURT: All right. So that would be the first 


time, is Friday morning? Because we would need to set up a 


Zoom link for that. 


MS. McGOVERN: Yeah. I think probably the safest 


thing to do, in light of the fact that we don't control how the 


witnesses are going to play, if perhaps we address this a 


little bit later. But I just wanted to advise that we're going 


to be needing the Zoom. 
MR. RIVERO: May we have one moment, Your Honor? 


THE COURT: Yes. Certainly. 


MR. ROCHE: Your Honor, before the jury comes in, I 
know I've been told I have a problem speaking too loud. I 
think Dr. Edman has the opposite problem. What I was hoping to 


do was give Dr. Edman one of these so that he could —- so that 


the mic picks it up better during the direct examination. 


THE COURT: Do you want to give that a try? Because 


it was very difficult to understand the testimony. 
MR. RIVERO: Your Honor, I thought it was my old ears, 
but I was having a hard time. 


THE COURT: I think it was everyone here. 
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Do you want to give it a try? 
MR. ROCHE: Turn it on. Give it a try. 


THE WITNESS: Test. 


MR. ROCHE: Better. 


THE WITNESS: Better? 


MR. ROCHE: Yes. 


MR. FREEDMAN: You can use both, Dr. Edman, so you 


can -- also put the other mic closer. 


MR. ROCHE: Thank you, Your Honor. 


THE COURT: All right. And with regard to the 


witness, just let us -- today's obviously Tuesday. So just let 


us know at some point today or tomorrow when you need the Zoom 
link. 
MS. McGOVERN: Thank you. 
THE COURT: Okay. All right. Let's bring in the 
jury. 
(Before the Jury, 10:19 a.m.) 


THE COURT: Good morning, Ladies and Gentlemen. 


Please be seated. It's good to see each of you. 


And we are ready to get back to work. You'll recall 


that we were in the beginning of Dr. Edman's testimony. 
And, Dr. Edman, let me remind you, you were previously 


placed under oath. And let us continue. 


MR. ROCHE: Your Honor, I know we have difficulty with 


positioning this in four dimensions. Can you see the 
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demonstrative if I place it here? 


THE COURT: A little bit 
MR. ROCHE: Okay. 
THE COURT: Okay. Yeah. Yeah. Okay. 


MR. ROCHE: And no, my handwriting didn't suddenly get 


better overnight. That was my colleague, Judy, who rewrote it 


for us. 


MR. RIVERO: May I step over here? 


THE COURT: Yes, of course. Of course. 


DIRECT EXAMINATION [CONTINUED] 


BY MR. ROCHE: 


Q. Good morning, Dr. Edman. So where we left off yesterday 


was your analysis and conclusions relating to forgery number 


one. And we're going to look at nine additional documents that 


you analyzed this morning, for a total of 10 documents. 
For those 10 documents, have you reviewed any evidence in 


this case produced by the Defendants or opined by the experts 


that anyone but Craig Wright was the one responsible for the 
manipulations? 
A. I have not. 


MR. ROCHE: Dorian, can we bring back up the 


presentation for -- where it was yesterday? The end of 
right before 456. 


(Pause in proceedings.) 
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MR. ROCHE: And I believe Plaintiffs' Exhibit 546 is 


already in evidence. 
MR. RIVERO: Judge, our screen isn't working again. 
THE COURT: Mr. Rivero, are you able to see -- look at 
another screen, or do you want us to stop the proceedings? 


MR. RIVERO: Judge -- I'll figure it out, Judge. 


THE COURT: Are you certain? 


MR. RIVERO: If it becomes a problem, I'll let the 


Court know, but let me see what I can do, Judge. 


THE COURT: We're going to bring someone in { 
right now. 

COURTROOM DEPUTY: I just sent Christian a message so 
they can come down. 

THE COURT: All right. And in answer, Mr. Roche, 546 
is in evidence. 

MR. ROCHE: Can we publish to the jury, please. 
BY MR. ROCHE: 


Q. Dr. Edman, is Plaintiffs' Exhibit 546 one of the other 


documents that you determined was a forgery? 
A. It is. 


Q. Okay. We'll refer to 546 as forgery number two. 


MR. RIVERO: Objection, Your Honor. Same objection. 


THE COURT: Yes. And, Mr. Rivero, why don't I give 


you a continuing objection with regard to -- 


MR. RIVERO: JI appreciate it. Thank you. 
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BY MR. ROCHE: 
Q. Dr. Edman, what does this document purport to be? 


This document purports to represent an email exchange 


between Dave Kleiman and Craig Wright from September 7th, 2012. 


Q. Rough -- less than a year before Mr. Kleiman passed away? 
A. 


Q. And are there any cryptographic signatures contained in 


this document? 
A. Yes. There are two of them. 


Q. And can you show us where the two cryptographic signatures 


are, or describe where they are on Plaintiffs' Exhibit 546? 


A. Sure. One is at the bottom of the left page and then one 


is at the bottom of the right page. 


Q. Okay. Let's start with the cryptographic signature on the 


bottom of the right page. 


MR. ROCHE: If we could take the -- down from the 


_ 


jury. We need to introduce a few exhibits into evidence. 


Dorian, could we bring up 546.1 and 546.2. 


(Pause in proceedings.) 


MR. ROCHE: Or we can do them one at a time, if 
easier. 

I think we have 546.2 on the right. 
BY MR. ROCHE: 


Q. Dr. Edman, what is 546.2? 


A. 546.2 is an analysis of the cryptographic signature { 
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546. 


Q. Okay. And did you extract that data during your review of 


the authenticity of forgery number two? 
A. I did. 
MR. ROCHE: Dorian, if you can go back to the 


PowerPoint. I think 546.1, we can review in the 


Go to the next. 


Perfect. 
BY MR. ROCHE: 


Q. Dr. Edman, what is 546.17 


A. 546.1 is the analysis of the other cryptographic signature 
in 546. 

MR. ROCHE: Your Honor, we would move to admit 546.1 
and 546.2 into evidence. 

MR. RIVERO: No objection, Your Honor. 


HE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 546.1 & 546.2 received into 


evidence. ) 


MR. ROCHE: Can we publish to the jury, please. 


BY MR. ROCHE: 


Q. Dr. Edman, what is the relationship between 546, which we 


the signature is on the top left, and 546.1, which is in 


bottom right? 


The bottom right shows the analysis of the cryptographic 


Signature in the top left. 
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Q. And is there a date associated with the cryptographic 


signature? 


A. There is. It indicates that the signature was created on 


February 28th, 2014. 


Q. So that signature is created the same day as forgery 
number one? 


A. Correct. 


Q. And does that date match the date the email was purportedly 


_ 


sent from Dave Kleiman to Craig Wright? 


t does not. 


MR. ROCHE: Dorian, could we go to the next slide, 


And if you can blow up the highlighted box. 
BY MR. ROCHE: 
Q. Dr. Edman, this is the email that's associated with the 
cryptographic signature we just looked at, correct? 
A. That is correct. 


Q. It reads: "The trust is set up in the Seychelles. I will 


arrange a shelf company to manage it in the UK, as we 


discussed, later. There is no rush there. I will leave you 


and myself off for now and leave it as non-trading. Just 


listen to some advice for once, Craig, and trust me to be your 


friend." 


And that email was purportedly sent from Dave to Craig. 


Dr. Edman, do you believe Dave Kleiman sent that email? 
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A. I do not. 


Q. Why not? 


A. Dave was dead at the time the signature for this email was 


sent. 
Q. Okay. 


A. Was created. 


Q. And did you analyze the other 


MR. ROCHE: And you can take down the blowup { 


BY MR. ROCHE: 


Q. Did you analyze the other signature contained within 


forgery number two? 


As did. 


MR. ROCHE: Can we go to the next slide. 


BY MR. ROCHE: 


It is. 


Is this similar to the signature we looked at in 546.1? 


Can you explain for the jury the relationship between the 


first signature in 546 and what we're looking at in 546.2? 


A. It is the signature or the analysis of the signature in the 


other email, the one on the left. This signature purports to 


have been made March 4th, 201 


Q. Okay. And does that match the date of the email? 


A. It does not. 


MR. ROCHE: Dorian, could we go to the next slide, 


And could you blow up the text in the 
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the chain that's highlighted. 


BY MR. ROCHE: 


Q. And this email was purportedly written from Dave to Craig 


on September 12th September 7th, 2012. "You set up the 


exchange in Australia and I get 10 percent of the company to be 


ng 


issued as 80/20 between myself 


and my father when it is 


running. It is confirmed that I have 320,832 Bitcoin and 


change. As agreed, I will not tell you who the others I have 


used here in the US are. We will exchange soon. You know this 


_ 


is a great opportunity for you to come over with that lady of 


yours and to see me. t needs to be soon. Too long. 
Respectfully, Dave Kleiman." 


Dr. Edman, in your opinion, did Dave Kleiman write that 


Why not? 


A. Dave was dead at the time the signature associated with 


this email was created. 


Q. Dr. Edman, did you determine any other documents produced 


in this litigation by Dr. Wright's team were forgeries? 


A. I did. 


MR. ROCHE: Dorian I believe, Your Honor, 
Plaintiffs' 135 has already been admitted into evidence. 


THE COURT: Yes. It's in evidence. 


MR. ROCHE: Dorian, could we go to the next slide, 
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please. 
BY MR. ROCHE: 


QO. Dr. Edman, is Plaintiffs' Exhibit 135 one of 


exhibits? 


A. It is. 


MR. ROCHE: We'll refer to 135 as forgery number 


three. 
BY MR. ROCHE: 


Q. Can you describe to the jury -- 


MR. ROCHE: And maybe if we can blow up the top half 


fF the page on the left? 


A little further down to sort of have the long strings 


F text included too. 


Yeah. Perfect. 
MR. ROCHE: 
Q. What is Plaintiffs' Exhibit 135? 


A. This is an email from Craig S. Wright to John Chesher, 


which forwards a purported email from Dave Kleiman to Craig 


Wright from October 31st, 2012. 


Q. And I see some long strings of text in the email from Dave 
to Craig. What are those long strings? 
A. Those are Bitcoin addresses. 

How do you know those are Bitcoin addresses? 


A. Visually they look like Bitcoin addresses and I also 


verified each one of them by looking them up on a block 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 73 of 264 


explorer called blockchain.info. 


Q. So you confirmed that those are real Bitcoin addresses? 


A. I did. 

MR. ROCHE: And if -- if you can actually blow that 
part of the email up again. 
BY MR. ROCHE: 


Q. From Dave to Craig, October 31st, 2012: "Craig, you need 


to use that Facebook picture of yours for a corporate profile. 


Then with the UK group you can be Bond and the villain all at 


the same time. Right now, the trust holds the following keys. 


And it goes on. 


Those are "the following" are the Bitcoin public 
addresses? 
A. Correct. 


Q. Dr. Edman, is this document a forgery? 


A. In my opinion, it is, yes. 


MR. ROCHE: And if you could open -- close that out 
and focus on the cryptographic signature, the box on the right. 
BY MR. ROCHE: 

Q. Did you analyze this signature? 


As JI did. 


MR. ROCHE: Dorian, if you could take that down and if 


you can take down the presentation from the jury. 


We'll move to 135.1. 
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BY MR. ROCHE: 


Q. Dr. Edman, what is Plaintiffs' Exhibit 135.1? 


A. This is my analysis of the cryptographic signature using 


GnuPG. 

MR. ROCHE: Your Honor, at this point, we would move 
to admit 135.1 into evidence. 

MR. RIVERO: No objection, Your Honor. 

THE COURT: Admitted into evidence. 


(Plaintiffs' Exhibit 135.1 received into evidence.) 


MR. ROCHE: Dorian, if we could go back to the 
presentation -- next. Yep. And -- great. 


BY MR. ROCHE: 


Q. Dr. Edman, what is the relationship between 135, the 
signature we see in the left, and 135.1 -- go ahead. What's 
the relationship? 
A. 135 shows that the signature -- or 135.1, rather, shows 
that the signature in 135 was created on March 2nd, 2014. 
March 2nd? 
Correct. 


So just two days after forgery one and two? 


Correct. 


s' Exhibit 


Dr. Edman, does that match the date in Plainti 


It does not. 


And do you believe Dave Kleiman sent this email to 
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Wright? 

A. Ido not. 

Q. Why not? 

A. Dave was dead at the time. 


MR. ROCHE: Your Honor, the next exhibit we'd like to 


show is 55, and I believe that's in evidence as well. 
THE COURT: Just one moment. 
(Pause in proceedings.) 


THE COURT: Yes. It is in evidence. 


BY MR. ROCHE: 


Q. Dr. Edman, what does Plaintiffs' Exhibit 55 show? 


A. This purports to show an email exchange between Dave 


Kleiman and Craig S. Wright on December 15th, 2012. 


Q. Dr. Edman, in your opinion, is Plaintiffs' Exhibit 55 a 


forgery? 


A. 


Q. Okay. We will refer to Plaintiffs' Exhibit 55 as forgery 


number four. 


Dr. Edman, how did you conclude Plaintiffs' Exhibit 55 was 


forgery? 
By analyzing the cryptographic signature. 
And that's the box highlighted? 
Correct. 
MR. ROCHE: If we could take that down. 


I want to just read the contents. From Dave to Craig: 
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"No need. There are several others from October if we come 


into any issues, but we only need one. Your trust is in the 


Seychelles. And you want to have nothing of mine in P, so it 


should all be good. We only need one dormant and untraded 


company to sit as the owner of Bitcoin we are mining into them. 
I am assuming you do not want W&K ID to be a director. The 
Brits do not allow this." 

If we could take down the presentation and show 
Dr. Edman 55.1 and 55.3. 
BY MR. ROCHE: 


Dr. Edman, what is Plaintiffs' Exhibit 55.1? 


55.1 shows metadata objects that I extracted from 55. 
So 55.1's metadata? 
Correct. 
And what's 55.3? 
55.3 is the analysis of the cryptographic signature in 55. 
Q. So you analyzed both the metadata and the cryptographic 
Signature in 55? 
A. Correct. 
MR. ROCHE: Your Honor, we move to admit 55.1 and 55.3 
into evidence. 
MR. RIVERO: No objection. 
THE COURT: Admitted into evidence. 


(Plaintiffs'’ Exhibits 55.1 & 55.3 received into evidence.) 


MR. ROCHE: Dorian, if we could go back to the next 
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page of the presentation. 

BY MR. ROCHE: 

Q. Okay. Dr. Edman, what does 55.1 show? I see there's a 
couple boxes. 


A. 55.1 is the PDF metadata. It shows that the PDF file is 


created March 26th, 2014 in the time zone UTC+11 and then 


_ _ 


modified about two and a half minutes later. The creator of 


the document appears to be a user named Craig Wright. 
MR. ROCHE: Dorian, if we could go to the next slide, 
please, 55.3. 
BY MR. ROCHE: 
Dr. Edman, is this the analysis of the cryptographic 


ture? 


is. 
Q. And what -- can you explain for the jury the relationship 


between 55 and 55.3? 


A. 55.3 is my analysis of the cryptographic signature in 55. 


Q. And I'm sorry. What's the date associated with the 
cryptographic signature? 
A. The date on the cryptographic signature indicates it was 


created March 2nd, 2014. 


Q. The same day as forgery number three and just a { 


fter forgery one and two? 


Correct. 


Does that signature match the date Dave Kleiman purportedly 
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this email to Craig Wright? 


t does not. 


Q. Do you believe Dave Kleiman sent this email to Craig 
Wright? 
A. Ido not. 


MR. ROCHE: Your Honor, I believe 452 is also already 


in evidence. 


THE COURT: Yes. It is in evidence. 


MR. ROCHE: Dorian, if we could go forward to the next 
slide. 
BY MR. ROCHE: 


Q. Dr. Edman, what is Plaintiffs' Exhibit 452? 


452 purports to show a screenshot of an application called 
Bitmessage. 


Q. What is -- you said Bitmessage. What is Bitmessage? 


A. Bitmessage is an encrypted peer-to-peer messaging system. 


Q. Okay. So what's the difference between Bitmessage and a 


normal text message? 


A. In Bitmessage, messages between users are relayed through 


other Bitmessage users as opposed to, say, an SMS text which is 


relayed through our phone provider. 


Q. So is what we're looking at here the purported history of 


Bitmessages between Craig and Dave? 
Yes. 


And the "From" field shows the sender, and the "To" 
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says -- shows who received it? 


A. Yes. 


Q. Now, I see it's like the screen looks like the Windows 


pop-up screen. Is this an electronic document we're looking 


A. . I believe this was produced as a scan of a hard copy. 


Q. All right. And what -- what does the message what is 


the purported date of the message that appears to 
highlighted in the printout? 


A. November 6th, 2012. 


MR. ROCHE: Dorian, could you blow up the top part of 


the messag or starting at: "Craig," the bottom half of the 


screen. 


Perfect. 


BY MR. ROCHE: 


Q. Reads: "Craig, as you wanted, the trust will offer the 


loan to you. The process is defined as follows: The keys are 


divided using Shamir's secret sharing scheme you had us work 


on. There are 15 key segments divided with a threshold of 12." 


Then it goes on to describe who holds those keys. "Uyen and I 


cannot let you know who the others are. You do not know them 


personally as far as I'm aware." The last line reads: "The 


remainder of the trust will vest when the conditions are 


fulfilled. As agreed, Dave." 


Dr. Edman, in your opinion, is Plaintiffs' Exhibit 452 
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authentic? 


Is it a forgery? 


In my opinion, yes. 


Q. We'll refer to this 452 as forgery number five. 


Dr. Edman, what is the basis for your 


forgery? 


opinion that 452 is a 


A. This particular message purports to have been received on 


November 6th, 2012. However, the Bitmessage application was 


not publicly released until November 19th, 2012. 


Q. So this program, Bitmessage, wasn't even released until a 


couple weeks after that message was sent? 
A. Correct. 


How do you know that? 


A. I reviewed the GitHub history for Bitmessage. 


interviewed the developer of Bitmessage, a gentleman named 


Jonathan Warren, and I also reviewed Jonathan Warren's 


deposition transcripts. 


Q. Okay. So let's break that down. You 


said: "GitHub 


history." Can you describe to the jury what you mean when you 


say you reviewed the GitHub history for Bitmessage? 


A. GitHub history -- GitHub is a website 


for sharing source 


code, and it lets you look back at sort ot 


F the development 


process associated with the software application. 


Q. And you said you interviewed Jonathan 


Warren and you read 
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his transcript. Who is Jonathan Warren? 


The developer of Bitmessage. 


The person who created this program? 


Correct. 


Is he also the individual we saw testify by video 


deposition I think two Fridays ago? 


A. I understand he did, yes. 

Q. Okay. Dr. Edman, what does a person need to have in order 
to send and receive a Bitmessage? 

A. You need to have a Bitmessage address which has associated 


with it certain private keys. 


Q. So I need a private key to send a Bitmessage? 


A. Correct. 


Q. Okay. And if I get a Bitmessage from somebody, can I see 
who sent it? 
A. You can see the address of the individual who sent it, 


which you can associate with a human readable name. 


Q. And so if I have somebody's private key for their 
Bitmessage, can I impersonate that person? 


A. Yes. 


MR. ROCHE: Dorian, if we can take from the jury. 


And you can go to Plaintiffs' Exhibit 613. 


BY MR. ROCHE: 


Q. Dr. Edman, what is Plaintiffs' Exhibit 613? 


A. 613 is a keys.dat file produced by the Defendant. 
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Q. So is it your understanding it was in the Defendant's 
possession, custody, or control? 


A. That is my understanding. 


Q. And did you review this during your analysis of Plaintif 
Exhibit 452? 
A. I did. 

MR. ROCHE: Your Honor, we move to admit 613 into 
evidence. 


MR. RIVERO: Objection, Your Honor. No foundation has 


been laid. This is a document that was shown to the -- to 


Dr. Wright, and they weren't able to lay a foundation. So we 
object to 613. 


MR. ROCHE: Your Honor, this document is not being 


offered for the truth -- the foundation is that Dr. Edman 


reviewed this. It was produced by the Defendant, and he's 


offering this document to show it, in fact, came from the 


Defendant's possession, custody, or control. 
THE COURT: Anything further, Mr. Rivero? 
MR. RIVERO: Your Honor, just to be clear, it is not 


being offered for the truth of the matter asserted. f that's 


the -- if that's understood, then we have no objection. 


THE COURT: The objection is noted. It's overruled. 


l be admitted into evidence. 


laintiffs' Exhibit 613 received into evidence.) 


MR. ROCHE: Dorian, if we could go back to the slide 
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and publish the 613 exhibit. 
BY MR. ROCHE: 


Q. Dr. Edman, what does Plaintiffs' Exhibit 613 show? 


A. 613 shows an excerpt from a Bitmessage keys.dat file which 
contains private keys and that are purportedly associated with 


Dave Kleiman. 


Q. Keys.dat file, can we start with that? What is a keys.dat 


file? 


_ 


A. It's a configuration file for Bitmessage that contains 


application settings as well as address blocks, addresses that 
you can use to send Bitmessageés. 
Q. So it's like a document used to store your keys. 


MR. RIVERO: Objection, Judge. Leading. 


THE COURT: Sustained. 


BY MR. ROCHE: 


Q. Can you use an analogy to describe what a keys.dat file is? 


A. It's sort of like a wallet that contains private keys that 


you can use to communicate with other Bitmessage users. 


Q. And what does the Bitmessage documentation say about 
keys.dat files? 


A. It says that your keys.dat files should be protected, 


because if the contents were disclosed it could be used to 


impersonate other Bitmessage users. 


Q. Do you agree with that description, that if it's not 


protected it can be used to impersonate somebody else? 
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Q. So is what we're looking at in P613 essentially a password 


file for a Bitmessage account? 


MR. RIVERO: Objection, Judge. Leading. 
THE COURT: Sustained. 
BY MR. ROCHE: 
Q. Dr. Edman, can you read the name associated with this 


particular private key? 


A. The "Label" field indicates that it's associated with Dave 


Kleiman. 


Q. And where do you understand this keys.dat file to have 


originated? 


A. I understand it was produced by the Defendant. 


Q. So, in essence, the Defendant had the ability to sign 


Bitmessages with an account associated with Dave Kleiman? 
MR. RIVERO: Objection. Leading. 
THE COURT: Sustained. 

BY MR. ROCHE: 


Q. What does this tell us about the Defendant's ability to use 


this keys.dat file? 


A. It tells us that the Defendant had the ability to create 


Bitmessages similar to the ones shown in, I believe it was 452, 
that purportedly came from Dave Kleiman. 
Q. And how do you know that this private key corresponds to 


the address on the screen associated with Dave Kleiman? 
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A. I used the Bitmessage software to verify that the private 


keys shown in this particular screenshot correspond to the 


address at the top associated with Dave Kleiman. 


Q. So you were able to use the software to verify that? 
A. Yes. 


Q. And were you able to determine when the last time this 


keys.dat file was used? 
A. Yes. The last hub key send time indicates that it was last 


used on, I believe it was February 28th, 2014. 


Q. February 28th, 2014. So forgeries one, two, three, 


and five were all created approximately three days from 
other? 


MR. RIVERO: Objection. Leading. 


THE COURT: Sustained. 


BY MR. ROCHE: 


O.. Dr. Edman -- we'll move on. 


MR. ROCHE: If we can take down from the jury and go 
to Plaintiffs" Exhibit 807. 
BY MR. ROCHE: 


Dr. Edman, can you see Plaintiffs' Exhibit 807? 


I can. 


Q. Dr. Edman, was this document produced by the Defendant in 


this litigation? 


A. Yes. 


Q. Do you understand whether or not this document was ever 
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submitted to the Court in this litigation? 


A. I understand it was. 


Q. And did you previously opine on this document in the 


context of that submission? 


As. tL did. 


MR. ROCHE: Your Honor, we move to admit Plaintif 


Exhibit 807 into evidence. 


MR. RIVERO: Objection. Hearsay, Your Honor. 


MR. ROCHE: Your Honor, it's not being offered for the 


truth of the matter asserted. It's being offered to show, one, 


that the Defendant had possession, custody, or control of this 
document, and two, that it was previously submitted in this 
litigation. 

THE COURT: The objection is overruled. It will be 
admitted into evidence. 


(Plaintiffs' Exhibit 807 received into evidence.) 


MR. ROCHE: If we could go back to the slide, please. 
BY MR. ROCHE: 


Q. Dr. Edman, what is Plaintiffs' Exhibit 807? 


A. 807 is a PDF that purports to represent an email from Dave 


Kleiman, with Dave's last name spelled incorrectly, to Uyen 
Nguyen on December 20th, 2012. 

Q. Where do you see his last name being spelled incorrectly? 
A. In the "From" field. 


MR. ROCHE: Could we highlight that. 
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BY MR. ROCHE: 
Q. So the "I" and the "E" are flipped? 
A. It appears so, yes. 
Q. Okay. 
MR. ROCHE: Dorian, could you highlight the -- or blow 
up the paragraph that's highlighted. 
BY MR. ROCHE: 
Q. From Dave purportedly to Uyen Nguyen: "I will ask you to 


_ 


be a director with me in W&K Information Defense Research. We 


are setting up a company in Australia and we'll move the assets 


back from Panama once this is complete. We placed them there 


to protect Craig." 


Dr. Edman, is this document an authentic email from Dave 


Kleiman to Uyen Nguyen? 


A. In my opinion, it is not. 


Q. Running out of space here. We're going to flip this over 


and refer to this, 807, as forgery number six. 


How did you determine that this document was a forgery? 


A. By analyzing the metadata associated with the document, as 
well as the cryptographic signature. 

Q. Both the metadata and the cryptographic signature in this 
document? 

A. Correct. 


MR. ROCHE: All right. We're going to have to move 


some things into evidence, so if we can take that down again. 
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801, 802, and 803, please. We can start with -- one 
by one. 
BY MR. ROCHE: 
Q. Dr. Edman, what is 807.1? 


A. This is a metadata object that I extracted from the PDF. 


MR. ROCHE: If we can go to 807.2. 
BY MR. ROCHE: 


Q. What is the document? 


A. This is a PDF object that I extracted from the PDF. 

Q. And when you say: "Extracted from the PDF," you mean you 
extracted it from 807? 

A. That is correct. 


Q. Okay. And what is 807.3? 


A. This is my analysis of the cryptographic signature in the 


document. 
Q. Cryptographic signature from 807? 
A. Correct. 
MR. ROCHE: Move to admit 807.1, 807.2 and 807.3 into 
evidence. 
MR. RIVERO: No objection. 
THE COURT: Admitted into evidence. 
(Plaintiffs' Exhibits 807.1, 807.2 & 807.3 received into 
evidence. ) 


MR. ROCHE: If we can go back to the -- all right. 
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BY MR. ROCHE: 


Dr. Edman, what is the relationship between 807 and 807.3? 


807.3 shows my analysis of the cryptographic signature from 


In particular, it shows that the signature was made March 


12th, 2014. 


Q. Does that match the date on the cover of the email 


Dave to Uyen Nguyen? 


A. t does not. 

MR. ROCHE: Dorian, if we could go to the next slide, 
please. 
BY MR. ROCHE: 
Q. Is there anything else about this document that indicates 
it is a forgery? 


A. The create date shown on line 12 indicates that the 


document was created April 17th, 2014 in time zone UTC+10. And 


then modified approximately five minutes afterwards. 


Q. Now, you —-— I think yesterday we looked at a timestamp that 


was UTC+11. Is there any explanation for why this document 


shows UTC+10 but the forgery number one showed UTC+11? 


A. UTC+10 and UTC+11 are two time zones predominately 


associated with Eastern Australia. It just depends on Daylight 


Savings Time down there. 


do you understand April to have occurred after Daylight 


in Australia? 
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MR. ROCHE: If we could, Dorian, go to 807.1. Oh, 
we're in -- 807.2. 
BY MR. ROCHE: 


Q. Dr. Edman, can you tell us what 807.2 shows us about 807? 


A. 807.2 is a PDF object that contains a marker called TouchUp 


Text edit, which is shown in the box on the left there. 


Typically, that indicates that portions of the following text 


have been modified. 


The red highlighted portions on the left indicate portions 


the text that have been modified which correspond to the red 


t on the right from 807. 

Okay. So I want to break that down. So 807 is a PDF? 
Yes. 

And can you open up and edit a PDF? 

You can. 

And the TouchUp Text edit, what does that indicate as to 


how or whether the PDF was modified? 


A. It's usually an indicator that portions of the text 


following the TouchUp Text edit marker have been modified. 


Q. And you said -- so I want to understand -- there's a bunch 


of numbers on the left that we've highlighted sort of halfway 


down the page. How do those correspond -—- because it's just a 
bunch of numbers. How does that correspond to the text on the 


right? 


A. So the letters and numbers highlighted in red, 
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characters there -—- so, for example, 0027 -- corresponds to a 


particular letter displayed on the right. 


Q. So it's a code for the letter changes that appear in the 


visible document? 


A. Correct. 


Q. Do you have any opinion about how the PDF f forgery 


number six was created? 
A. do. 

MR. ROCHE: Your Honor, I believe 856 is already in 
evidence. 


THE COURT: Yes. It's in evidence. 


MR. ROCHE: Don't go to the next slide yet. 
BY MR. ROCHE: 


Q. How do you believe the PDF in 807 was created? 


A. I believe it was created from an email that was sent from 


Craig Wright to Craig Wright, and then a PDF created of that 
email. 


MR. ROCHE: Okay. Dorian, could we go to the next 


please. 
ROCHE: 


this the email you were referring to? 


is. 


And what does the comparison between 807 and 856 show? 


It shows that the messages are identical and they contain 


identical cryptographic signatures, except for the email on the 
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right was sent April 16th, 2014. 


Q. April 16, 2014. And did you compare the cryptographic 


signatures -- 
A. I did. 
CO. = in G07? 
What did that comparison show? 


A. They're identical. 


Q. So forgery number six was a PDF, but what we're looking at 


on the right is the email that forgery number six comes from? 
A. Correct. 

Q. And did you analyze any of the headers contained within 
856? 


As TL did. 


MR. ROCHE: If we could take it down from the jury. 
And, Dorian, if we could please pull up 856.1 and 
856.2. 
BY MR. ROCHE: 


Q. Dr. Edman, what are 856.1 -- let's start with 856.1. 


A. 856.1 shows the mail transport headers that I extracted 


from the email. 
QO. And what does 856.2 show? 


A. 856.2 is what's called a GeoIP lookup that maps an IP 


address to an approximate physical location. 


Q. And did you, yourself, pull the results from 856.2? 


As I dad. 
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Is it reliable? 


I believe so. 

MR. ROCHE: Your Honor, we move to admit 856.1 and 
856.2 into evidence. 
MR. RIVERO: No objection, Your Honor. 


HE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 856.1 & 856.2 received into 


evidence. ) 
MR. ROCHE: If we could go to the next slide, please. 
BY MR. ROCHE: 


Q. Okay. A lot of text here. Let's slowly walk through the 


highlighted boxes on 856.1 and tell the jury what that tells us 


about the email in 856. 


A. Sure. So starting with line 40, the "From" field indicates 


this email was sent from craig.wright@hotwirepe.com. 


Line 41 shows the "To" field indicates the email was sent 


to craig.wright@itmasters.edu.au. 


Line 42 shows the subject was: "Appointment letter" with 
three P's. 

And then line 45, the "Date" field indicates the email was 
sent April 16th, 2014. 

April 16th, 2014? 


Correct. 


That's the date we wrote up on the board f forgery six? 


It is. 
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Edman, I see there's a final line there pointing to 


What does line 51 show? 


line 51 on the left shows that the email originated f 
the IP address 58.160.32.123, which, according to the GeoIP 
lookup I did, corresponds to Eastern Australia. 

Q. All right. Let's talk about that a little bit. What is an 


IP address? 


A. An IP address is sort of like a phone number for a computer 


or device on the Internet. 
Q. Okay. And are you able to tell —- I guess what does 856.2 


tell us about that IP address? 


A. It tells us that the IP address at the time I pert 


this lookup corresponded to Eastern Australia. 


Q. And were you here when the Defendant testified he lived in 


Australia in 2014? 


A. I was. 


Q. Okay. Now, did you review any other documents that were 


created around the same time that forgery number six was 


created? 
A. I did. 
MR. ROCHE: If we could take the document down. 


And go to -- oh, from the jury. My bad. 


And go to the next slide, 808. 
BY MR. ROCHE: 


Q. Dr. Edman, what is Plaintiffs' Exhibit 808? 
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A. 808 is another PDF that purports to represent a separate 


email from Dave Kleiman to Uyen Nguyen on December 20th, 2012. 


Q. Dr. Edman, was this document produced by the Defendants in 


this litigation? 

A. I understand it was, yes. 

Q. Do you understand whether or not it was ever submitted to 
this Court? 

A. I understand it was, yes. 


Q. And did you previously opine on this document in the 


context of that submission? 


A. I-did. 


MR. ROCHE: Your Honor, we move to admit Plainti 


Exhibit 808 into evidence. 


MR. RIVERO: Objection. Hearsay, Judge. We don't 


think it's admissible as substantive evidence but only as a 


demonstrative. 


MR. ROCHE: It's admissible because it's going to show 


the Defendant's possession, custody, and control of the 
document. 
THE COURT: The objection is noted. It's overruled. 


lL be admitted into evidence. 


laintiffs' Exhibit 808 received into evidence.) 


MR. ROCHE: If we could publish to the jury, please. 


Thank yo 
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BY MR. ROCHE: 


Q. Dr. Edman, what does Plaintiffs' Exhibit 808 show? 


A. 808 shows an email from Dave Kleiman -- and again with 


Dave's last name spelled incorrectly -- to Uyen Nguyen on 


Thursday, December 20th, 2012. 


Q. Okay. And it says: "Uyen, I am glad you will accept being 


a director of WéK. As soon as I am out of the VA, I will get 


all of the paperwork fixed for the company. We will make sure 


it is maintained as I'ma little behind. Nothing too bad, but 


old illnesses. I will be back soon." And later it's signed 


"Dave." 


Dr. Edman, in your opinion, is Plaintiffs' Exhibit 808 a 


forgery? 


A. 


Q. Okay. We will refer to this as forgery number seven. 


MR. ROCHE: I apologize for my handwriting 


progressively getting worse. 


BY MR. ROCHE: 


Q. Dr. Edman, how did you determine that 808 was a forgery? 


A. By analyzing the metadata and contents of the PDF. 


MR. ROCHE: Could we take down and put up 807.1. 
ROCHE: 


Edman, what is Plaintiffs' Exhibit 807.1? 


is metadata that I extracted from the PDF {f 


MR. ROCHE: And let's go to 808.1. 
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BY MR. ROCHE: 


Q. What is 808.1? 


A. This is metadata that I extracted from 808. 

MR. ROCHE: And can we also bring up 808.2. 
BY MR. ROCHE: 
Q. Dr. Edman, what is 808.2? 


A. This is a PDF object that I extracted from 808. 


MR. ROCHE: I believe 807.1 was already in evidence. 
So move for 808.1 and 808.2 to be admitted into evidence. 
MR. RIVERO: No objection. 


HE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 808.1 & 808.2 received into 


evidence. ) 
MR. ROCHE: If we could go to -- back to the slides, 
please. 


BY MR. ROCHE: 


Q. All right. How did you determine 808.1 was a forgery? 


A. So if we look at the metadata, you see that on line 12, in 


both boxes, for instance, the two documents have the same 
create date. If you look at line 11, you see that 808 was 
modified about five minutes after 807. 

MR. ROCHE: Let's highlight 11 and 12, please, in 
both —- 807.1. 


BY MR. ROCHE: 


Q. And before we go on, 807.1 is metadata taken f Forgery 
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number six? 


A. Correct. 


Q. And 808.1 is metadata that you extracted from 808? 


MR. RIVERO: Objection. Leading. 


THE COURT: Sustained. 


BY MR. ROCHE: 


Q. What is 808.1? 


A. 808.1 is metadata that I extracted from 808. 


Q. Okay. So besides the create date and modify date, is there 


anything else about the metadata in 807.1 and 808.1 that 


indicates that forgery number seven is a forgery? 


A. Yes. If you look at lines 15 and 16 from both metadata 


objects, you see that the two documents have the exact same 


document ID, but different instance IDs. 


Q. Okay. So line 15 is the document ID. That's the 6a5e8226 
number? 


A. Correct. 


And they're the same in both 807.1 and 808.1? 
Correct. 


What does that tell us? 


It tells us that the they are basically two revisions of 
exact same document. 


And the -- what is an instance ID? 


So a document ID identifies a particular document, but an 


instance ID identifies a revision of that document. 
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Q. Can you describe for the jury an example of how someone 


would create two documents with the same document ID but 


different instance IDs? 


A. Sure. If you open a document and then modify it and say 


that it is a new document, it will have the same document ID 


but different instance IDs. 


Q. So if you copy a file on your desktop, that would have the 


same document ID? 
A. It would. 

MR. ROCHE: Let's go to the next slide, 808.2. 
BY MR. ROCHE: 


Q. All right. Dr. Edman, this looks similar to 807.2. Can 


tell what 808.2 tells us about how forgery number seven was 


created. 


A. The red boxes on the left in 808.2 correspond to the 


modifications that were made in 807. The blue highlighted text 


corresponds to additional modifications that were made to 


create 808. In particular, you can see that certain portions 


of the time associated with the purported email were changed. 


— 


Q. So the edit in between forgery number six and forgery 


number seven shown here is the time? 
A. Correct. 


MR. ROCHE: Dorian, if we could go to the next slide, 
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BY MR. ROCHE: 


Q. All right. We're looking at 807 on the left from Dave to 


Uyen, and 808 on the right from Dave to Uyen, forgery number 


six and forgery number seven. Did Dr. Wright submit 807 and 


808 to this Court during this litigation? 


A. I understand that he did. 


Do you understand the context of those submissions? 


A. My understanding is that they were submitted in a previous 


motion, as I understand it, to get the case thrown out. 


MR. RIVERO: Objection. Objection, Your Honor. 


Objection. This misstates the procedural history of this case 


and this witness has no expertise 


THE COURT: The objection is sustained. 

Ladies and Gentlemen, you will disregard that last 
comment. 
BY MR. ROCHE: 


Q. Did you previously file affidavits with this Court showing 


that forgeries number six and seven were, in fact, forgeries? 


As, 1 ids 


Q. Were these the only documents filed by the Defendant in 


oT og 


this case that you testified were forgeries? 


A. No. 
Q. We'll add a star here to indicate that these were 
submitted -- 


MR. RIVERO: Objection, Your Honor. Objection. 
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Misstates the procedural history of this case and there's no 


_ 


Tact. 


record evidence right now of that 


MR. ROCHE: Your Honor -- 


MR. RIVERO: This witness can't testify to that, 


MR. ROCHE: Your Honor, if we may have a sidebar? 
THE COURT: Yeah. Come on forward. 
(At sidebar on the record.) 

MR. ROCHE: In your order overturning Judge Reinhart's 
sanctions -- and I have a copy for you, Mr. Rivero -- that -- 
you said that: "Plaintiffs have not carried their burden to 
show that default sanctions are appropriate. Instead, they 


have laid the foundation for an overarching theme that the 


Defendant has run a risk-benefit analysis to determine that 


forgery and perjury is an affordable and, in fact, efficient 


mechanism to fight this case. 


"The evidence and arguments Plaintiffs raise in this 


regard can be used effectively to persuade a jury, but they do 


not establish bad faith by clear and convincing evidence." 


So the point of your order was to show the fact that 


he did this to the jury. 


COURT REPORTER: JI can't hear you. 


THE COURT: Response? 


MR. RIVERO: Judge, they are getting a full chance to 


establish, including the use of the word "forgery," everything 
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they say that this witness can testify about, but they are now 


_ 


asking him to testify about the procedural history of the case. 


And some of these statements -- first of all, he doesn't have a 


basis. He's not an expert about the procedural history of the 


case. And some of these statements are incorrect, Judge. 


As a matter of fact, there was a document that they 


have attempted to use that was withdrawn, as the Court may 


recall. So this is a complicated procedural history, Judge. 


They may not be able to do that with this witness. But if they 


want to do that, then they could use other methods. They would 


have to show the procedural history. But to now ask this 


gentleman, who is not a lawyer and does not know what happened, 


it's just not the right way to do it. They're getting a full 


BT ong 


exposition of their position. 


MR. ROCHE: Your Honor -- and during Craig Wright's 


testimony, you objected on privilege grounds establishing that 


it was filed through him. Dr. Edman -- I understand the 


objection that you sustained to his testimony about what those 
submissions were about -- 
THE COURT: It was with regard to his decision as 


what to provide. 


MR. ROCHE: Correct. But the fact -- just to the { 


that they were submitted during this litigation -—- 


THE COURT: And —- 


MR. ROCHE: -- is the only thing I ask f 
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permission -—- 
THE COURT: And, Mr. Roche, let me say that you 


certainly have the right to refer to a document provided by the 


Defendant. It's clear the Bates stamp shows the "DEF," but I 


am not going to permit a rehashing of what occurred pretrial in 


this case, including any attempts to dismiss the case, any 


attempts to show that something was or was not a forgery. 


Anything pretrial is not admissible in this trial. 


You are free to use this expert in any way you choose in terms 


of his expert opinions, but not with reference to what was 


filed, what was argued, what was presented pretrial. It's not 


appropriate. 


MR. ROCHE: So I only ask for clarification because 


we're about to get it into then, so we don't have to come back 


up here -- is there's an affidavit, a sworn declaration, that 


he made during this litigation that we want -- that is already 


in evidence 


THE COURT: Well, that affidavit is in evidence. 


MR. ROCHE: Right. 


COURT: But the continued ref 


ROCHE: To the litigation. 


COURT: when the affidavit was presented -- 
FERNANDEZ: Got it. 
COURT: -- and for what purpose, is inappropriate. 


ROCHE: Okay. Got it. 
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(End of discussion at sidebar.) 


MR. ROCHE: All right. If we could go to the next 


Ss ' 


slide which was admitted into evidence as Plainti 


Reni bit O22 . 
BY MR. ROCHE: 

Do you recognize this document? 

I do. 
Q. All right. I just want you to describe what the document 
is, not the context or the circumstances surrounding the 
document. 


A. This is a sworn declaration of Dr. Craig S. Wright 


regarding a number -- the authenticity of 


MR. RIVERO: Objection, Judge. The document speaks 


for itself. Again, why does this witness have any expertise? 
THE COURT: Yeah. The objection is sustained. It's 

in evidence. 

MR. ROCHE: Okay. 


BY MR. ROCHE: 


Q. And do you understand that as part of this declaration 


Dr. Craig Wright swore that certain documents were authentic? 


MR. RIVERO: Objection, Judge. Leading, and it's the 


same subject matter. 


THE COURT: It's in evidence. You may certainly re! 
to any portion of the exhibit as opposed to paraphrasing. 


MR. ROCHE: Okay. 
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BY MR. ROCHE: 


Q. Did any of the documents in Plaintiffs' Exhibit 822 -- did 


you review any of the documents that Dr. Wright submitted in 


connection with Plaintiffs' Exhibit 822? 


A. I did. 
Q. And did you determine that any of those that were sworn to 


be authentic are, in fact, forgeries? 


A. In my opinion, yes. 


MR. ROCHE: Your Honor, can we check if 


evidence? I believe it is. 


THE COURT: Yes. It's in evidence. 


MR. ROCHE: Dorian, if we could go to the next 
document, please. 


BY MR. ROCHE: 


Q. All right. We're looking at Plaintiffs' Exhibit 35. 


this one of the documents that Craig Wright swore was 


authentic? 
FG's. 


Dr. Edman, is Plaintiffs' Exhibit 35 authentic? 


In my opinion, no. 


All right. Is it a forgery? 


In my opinion, yes. 
Okay. We'll refer to this as forgery number eight. 


And who purportedly sends and receives this document? 


This document purports to represent an email from Dave 
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Kleiman to Craig S. Wright. 


Q. Okay. And it says -- 


MR. ROCHE: Dorian, could you highlight the date of 


the document, Friday, June 24th, 2011. 


BY MR. ROCHE: 


Q. It states: "Craig, I think you are mad and this is risky, 


but I believe in what we are trying to do. Respectfully, Dave 


Kleiman." Then there is a number of attachments called Tulip 
Trust.pdf. 
MR. ROCHE: Could we highlight those? 


BY MR. ROCHE: 


Q. Dr. Edman, do you know how Plaintiffs' Exhibit 35 was 


collected and produced in this litigation? 


A. I understand it was produced as a scan of a hard-copy 


document. 


Q. So how did you determine that this document was a forgery 
that was produced aS a paper copy? 


A. I identified an electronic document among the documents 


produced by the Defendant that appears to correspond to this 


particular paper copy. 
MR. ROCHE: Dorian, if we could pull up 35 and 514, 
the next slide. 
BY MR. ROCHE: 
Q. Okay. Dr. Edman, we looked at 35. What are we looking at 


in Plaintiffs' Exhibit 514? 
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A. 514 is the electronic copy identified that appears visually 


identical to the document in P35. 


Q. And the document on the right which has been introduced as 


51 -- it's got the same date and -- as the date in 35, correct? 


MR. RIVERO: Objection. Leading. 


THE COURT: The objection is sustained. 


BY MR. ROCHE: 


Q. Can you please compare the dates between 35 and 514. 


A. They're identical. 
Q. And did you review any other documents that appear visually 


Similar to 35 and 514? 


As, J digs 


MR. ROCHE: Dorian, if we could pull up -- oh, this 


isn't published to the jury. Can we publish this to the jury, 
please. 


Thank you. 


If we can just -- it's the "Date" fields that are 


highlighted in the top. 


Let's move forward to 514 and 518. 
BY MR. ROCHE: 
Q. Okay. On the left, I see 514 of the document we just 


looked at. What is 518? 


A. 518 is a separate electronic document that appears similar 


to 514 but has a different date in the "Date" field. 


Q. Okay. Can you compare for the jury the differences in 
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those dates? 
A. Sure. 518 has a date of October 17th, 2014, but 514 has a 
date of June 24th, 2011. 


Q. Okay. Were you here during Craig Wright's testimony when 


an email from Denis Mayaka to Craig Wright was shown to the 
jury? 
A. I was. 


Q. And do you understand -- what did that email show? 


A. That email, as I recall, showed the purchase of a shelf 


company called Tulip Trading, Ltd. 


Q. And what was the date on that email from Denis Mayaka to 


Craig Wright? 


A. I believe that was also October 17th, 2014. 


Q. The same date as Plaintiffs' Exhibit 518? 
MR. RIVERO: Objection. Leading. 
THE COURT: Sustained. 


BY MR. ROCHE: 


Q. All right. Let's start with -- oh, Dr. Edman, in your 


opinion, is there a connection between 518 and 514? 
A. Yes. 
MR. ROCHE: All right. Let's start with 518. We're 


going to have -- let's do 514.1, 518.1, and let's take it down 


from the jury. 
BY MR. ROCHE: 


QO. Dr. Edman, what's 518.1? 
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A. 518.1 is a PDF metadata object that I extracted from 518. 


MR. ROCHE: And do we have 514 -- or we could go to 
514.1. 
(Pause in proceedings.) 
MR. ROCHE: Let's do 518.2 and 518.7. 518 
BY MR. ROCHE: 


ll right. Dr. Edman, what is 518.7? 


18.7 is a printout of a Microsoft website showing an 


Outlook version history. 


MR. ROCHE: Why don't we go back to the PowerPoint and 


we can show Dr. Edman 514.1 and 518.2. 


BY MR. ROCHE: 


Q. All right. What is 518.2? 


MR. RIVERO: I'm sorry, Judge. I'm just having 


trouble following the reference to exhibit numbers because 


they're not matching up with what I'm seeing. So I'm confused 


at this point. I'm looking at 518.2, but there is a reference 
to another number. 

MR. ROCHE: We haven't shown 518 -- we've just put 
518.2 on the screen. 

THE COURT: Okay. That's not being shown to the jury 
yet, correct? 

MR. ROCHE: 
BY MR. ROCHE: 


Q. Dr. Edman, what is 518.2? 
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A. 518.2 shows a PDF metadata object that I extracted { 


S18. 


MR. ROCHE: And I think if we scroll though we'll fi 
514.1. If we can just click through the slides. 

Keep going. 

Go one more. 

There we go. 
BY MR. ROCHE: 
Q. And what is 514.1? 
A. 514.1 shows an excerpt of a metadata object that I 
extracted from 514. 


MR. ROCHE: We move to admit 514.1, 518.1, 518.2, and 


518.7 into evidence. 
MR. RIVERO: No objection. 
THE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 514.1, 518.1, 518.2 & 518.7 received 


into evidence.) 
MR. ROCHE: Thank you. 
If we could go back to 518.2. 
Perfect. There we go. 

BY MR. ROCHE: 


l right. A lot of exhibits admitted there. I think 


looking at 518.2, which you testified was extracted from 


518. Can you explain to the jury what we are looking at in 


518.2? 
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18.2 is a PDF metadata object from 518. If you look at 


line 13, it shows that this document was created purportedly on 


July 12th, 2011 in time zone UTC+10, but modified five days 


before the document was even created, as shown in line 12. 


Q. So what's the significance of the fact this was modified 


five days before it was created? 


A. Certainly the dates in the metadata are inconsistent. 


Okay. Does that show evidence of manipulation? 
Quite possibly, yes. 


All right. And if we look at lines 20 through 23 -- 


MR. ROCHE: If we can highlight 20 to 23. 


BY MR. ROCHE: 


Q. Walk us through the dates and the information in those 


lines. 


A. Lines 20 through 23 provide additional information 


regarding the email that was used to create this PDF. 


Line 20 shows that it was created from an email from 
craig@panopticrypt.com. 

Line 21 shows that the email was sent to 
craig@panopticrypt.com. 

The subject is: "Requested attached," as shown in line 22. 


And line 23 indicates the date associated with the email as 


October 17th, 2014 in time zone UTC+10. 
518.2 is metadata extracted from 518? 


Correct. 
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Q. So I want to understand. Why does the metadata in lines 12 


to 13 -- can you explain why there is a difference between the 


dates in lines 12 to 13 and the date in line 23? 


A. The date in line 23 likely came from the dates associated 


with the email used to create the PDF, whereas the dates in 


lines 12 through 13 came from the computer that was used to 
create the PDF. 
Q. And do you have an opinion as to which date is more 


reliable? 


A. In my opinion, I would rely more on the date { 


email. 


Q. And why is that? 


A. Because that typically comes from a third-party source like 


an email server, your ISP, as opposed to the "Date" field which 


comes from the computer. 


QO. So -- but the date in line 23, that comes from the email 


server that this email is routed through? 
MR. RIVERO: Objection. Leading. Judge, this is -- 
COURT: Sustained. 
RIVERO: -- an expert witness. 
COURT: Mr. Roche? 
MR. ROCHE: Yeah, sure. 
BY MR. ROCHE: 


Q. Line 23, how is that date applied in the metadata? 


A. That date comes from the date associated with the email. 
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Okay. All right. I want to talk -—- oh, and if we look at 


the time zone, what's the time zone associated with the 


modified and create dates? 
A. UTC+H10. 
Q. And can you remind the jury what geographic region UTC+10 
is associated with? 
A. Eastern Australia. 
Q. I want to look at this metadata a little more. 
MR. ROCHE: Can we go to the next slide. 


BY MR. ROCHE: 


Q. Okay. Let's start with lines 60 to 64. What do those 


lines show? 


A. Line 60 shows the email was sent { 
craig@panopticrypt.com. 


Line 61 shows the email was sent to craig@panopticrypt.com. 


Line 62 shows the subject was requested attached. 
And line 63 shows that the date, according to the computer 


that sent the email was June 24th, 2011 in time zone UTC+10. 


Q. Dr. Edman, can somebody manipulate the date associated with 


a computer? 
A. They can. 


MR. RIVERO: Objection. Leading. 


THE COURT: Overruled. 


BY MR. ROCHE: 


Q. How would one manipulate the date associated with their 
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computer? 

A. You can essentially just right-click on the clock and 
change your date settings and change the date and time 
associated with your computer. 

Q. And let's talk through lines 49 through 52. What do lines 


49 through 52 show? 


A. Lines 49 through 52 show information added by the first 


email server that relayed this message when it was sent. 


In particular, line 49 shows that this email was sent { 


a computer likely called PCCSWO1. 


Line 50 shows the account used to send the email was 
craig@panopticrypt.com. 
And in line 51, we show that the date this email server 


received and processed this email was October 17th, 2014. 


Q. Okay. And I want to look at line 49, P -- CSW. What is 


that field? 
A. That field shows the name of the computer device that sent 
the email. 

And "PC" stands for? 

Typically, personal computer. 

And is there any significance to the CSW? 

It does correspond to the Defendant's initials. 

MR. ROCHE: Okay. And if we could go back to the 


previous slide. 
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BY MR. ROCHE: 


Q. Earlier, you were explaining the difference between the 


email added by the email server and the email on the computer. 


Can you give the jury an analogy for the date added by the 


email server? 


A. Sure. So if you think of sending a letter through the post 


office, the date added by the computer would be kind of like 


the date that you write on the letter, whereas, the date added 


by an email server is more like a stamp added by the post 


oO 1Ce. 


Q. And so, in your opinion, which date is more reliable? 


A. I would rely on the latter, the date added by the post 


office. 


Q. And what is that date? 
A. October 17th, 2014. 

MR. ROCHE: And let's go to the next slide, please. 
BY MR. ROCHE: 


Q. All right. We're looking at line 71 from 518.2 and Outlook 


oT og 


version history from 518.7. What does the comparison between 


these two exhibits show? 


A. 518.2 on line 71 shows that this email was sent using a 


program called Microsoft Outlook Version 15. 


518.7 shows that Microsoft Outlook Version 15 corresponds 
to what was publicly known as Outlook 2013. 


Q. Was Outlook 2013 available in June 2011 when this date 
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was -- when this email was purportedly sent to Dave? 


A. Not to my knowledge. 


Q. Can somebody send an email with software that doesn't even 
exist yet? 
A. No. 

MR. ROCHE: Dorian, if we could go to the next slide, 
please. 
BY MR. ROCHE: 


Q. All right. Back to 518. Dr. Edman, the PDF appears to 


show that was sent by Dave Kleiman to Craig Wright. Did you 


examine how that change was made? 
A. I did. 

MR. ROCHE: Dorian, if we could go to the next slide, 
please. Oh, actually, let's go back and take it down and show 
518.3 and 518.4 to Dr. Edman. 


Your Honor, it's 11:25. This will probably be five to 


10 more minutes. Should we take a break now? 


THE COURT: Certainly. This would be a good time. 


Ladies and Gentlemen, let's take a 20-minute recess. 


(Jury not present, 11:33 a.m.) 


THE COURT: We're on a 20-minute recess. 


MR. FREEDMAN: Your Honor, Plaintiffs have a 


time-sensitive issue we have to raise with the Court. I have 


to ask Dr. Edman to step outside for a moment. 


THE COURT: All right. Thank you, sir. 
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step outside. 
Go ahead and have a seat. 
(Pause in proceedings.) 
MR. FREEDMAN: Your Honor, it's come to our attention 
while Dr. Edman was on the stand that at 10:07 today, which I 


believe corresponds to when Mr. Rivero was arguing that 


Dr. Edman should not be able to use the word "fraud" in his 


testimony, Dr. Wright has posted to his Slack message: "You 


know that you can sue, quote/unquote, experts who give 


misleading evidence, statements of fraud when there is no 


evidence of intent?" 


Your Honor, we are concerned that this is a witness 


intimidation tactic. There are many more witnesses that are 


coming. Dr. Wright has a significant amount of resources and 
is well-known for suing people around the world, and we are 
concerned this will affect the testimony that this witness and 


others will be giving in this case. 


THE COURT: Mr. Rivero or Ms. McGovern, is there any 
dispute that Dr. Wright has been posting messages on his Slack 
account? 

MR. RIVERO: Judge, of course I've been observing this 


examination and I have absolutely no idea. 


THE COURT: Well, why don't we find out. 


MR. RIVERO: Exactly. But, Judge, may I have the 


break to figure out what -- this is the first time I hear of 
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I could have a few minutes, Judge. We are on a break 


the proceeding. 

THE COURT: All right. I'll see you back here in 15 
minutes. 

(Recess from 11:30 a.m. to 11:48 a.m.) 

THE COURT: All right. Back on the record. Go ahead 
and have a seat. 

All right. Addressing the Slack messages by 
Dr. Wright at 10:07. 

Mr. Rivero? 

MR. RIVERO: Your Honor, I have reviewed the Slack and 
can confirm that the words that were read by counsel, that line 
is in that Slack communication, which was the question the 
Court had asked me. 

Your Honor, without waiving privilege, I have 


discussed this -- I want to say to the Court, counsel -- not 


just Ms. McGovern and I, but all counsel were unaware, of 
course, and that's why I wasn't able to answer the question, 


Judge. 


I have counseled my client to stay off of Slack, 


Judge, and that is my instruction. If I can say not -- Your 


Honor, that is full stop period on that. But I just want to 


say, we take serious issue with the monitoring we think there 


is, and I am going to do a cross-examination of this witness 


about this because this came up in his deposition. But that's 
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a separate subject, Judge. And the context is a long 


discussion of another case that Dr. Wright has. 


I am not excusing anything, Judge. I repeat, I've 


discussed it with Dr. Wright. I am confirming to the Court 


that that statement is there and I'm confirming to the Court my 


instruction. And, Your Honor, if there is something else the 


Court would direct me to do, I would, of course, consider 


whatever I could do. 


THE COURT: Mr. Freedman, how are the Plaintif 


prejudiced in this respect? 


MR. FREEDMAN: I'm sorry, Your Honor? 


THE COURT: How are the Plaintiffs prejudiced in this 


respect? The Court hasn't issued a gag order. If a party to 
this action wants to post messages, whether it's through Slack 


or Instagram or any other medium, I'm at a loss as to where the 


prejudice is to the Plaintiffs. 


MR. FREEDMAN: Your Honor, the prejudice here is 


Simply because -- I would take no issue for Dr. Wright. He can 


say whatever he wants on Slack whenever he wants. The problem 


is he crosses the line when he suggests he's going to sue 


expert witnesses for their testimony here in court today. 


That prejudices the Plaintiffs' ability to put ona 


case. That prejudices our ability to get witnesses who will 


testify, both fact and expert witnesses, who don't want to go 


toe-to-toe with a billionaire who could sue them and run a 
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significant legal bill up for them when they don't have nearly 


enough assets to defend against that case. 


THE COURT: Well, do you believe this has had a 
chilling effect on Dr. Edman's testimony? 

MR. FREEDMAN: As far as I'm aware, Dr. Edman does not 
yet know about it. But, Your Honor, it's not just Dr. Edman. 


I'm sure Dr. Edman will find out about it because the press 


attends these proceedings. And so, if he's on -- I don't know 


what he's doing now. If he went on social media to check his 


Facebook messages, he may see it and it may have a chilling 


effect on him. But he's not the only witness in this case, 


Your Honor. There are others that are coming. There are other 


experts that may need to be presented in rebuttal, and this is 


a clear intimidation tactic and it's inappropriate and it will 


prejudice Plaintiffs' ability to put on its case. 


THE COURT: So what is the relief that you're seeking, 


MR. FREEDMAN: First, Your Honor, I would seek an 
admonishment from the Court directing him to stop intimidating 


witnesses, one. 


And beyond that, I'm not sure, Your Honor. We found 
out about it. We wanted it to stop immediately. We don't want 


it to continue and so that's why we raised it. I'd like a day 


to talk to my co-counsel to see if there's anything else we 


might seek, but in the interim a direct admonishment from the 
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Court to refrain from doing that. 


THE COURT: And, Mr. Rivero, you have reviewed 


Dr. Wright's message and it is, in fact, a type of intimidation 


toward witnesses? 

MR. RIVERO: No, Judge —-— 

THE COURT: Well, read it to me. Read to me what 
Dr. Wright posted. 

MR. RIVERO: As soon as I can have it -- 

MR. FREEDMAN: Your Honor, it says: "You know" —- 
this was literally as -- I believe this was literally as 


Mr. Rivero was arguing that Dr. Edman should not be able to use 


the word "fraud" because it requires intent -- "forgery." 


sorry. 


Dr. Wright posted at 10:07: "You know that you can 


sue, quote/unquote, experts who give misleading evidence." And 


then shortly thereafter he said: "Statements of fraud where 


there is no evidence of intent, dot, dot, dot." 


It's a clear expression to sue Dr. Edman for his use 


fF the word "forgery" in his testimony when there's no evidence 


intent. 


THE COURT: All right. Well, I certainly don't see 


how it could be interpreted in any other way. 


MR. RIVERO: Judge, I'm sorry. I'm looking -- I don't 


have the same then I'm going to have to ask for time, Judge, 


because I'm looking at a string that doesn't include the later 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 122 of 254 


statement and I'm looking at it on a device. 


Maybe if I could be shown. 


(Pause in proceedings.) 


MR. RIVERO: Judge, I'm seeing two different things. 


Your Honor, if we're going to go this way, I would ask -- I 


have seen one thing which is directly off a device. And can I 


please -—- 


FREEDMAN: Why doesn't he ask his client if 


RIVERO: Sir, can I please finish what I'm saying? 


FREEDMAN: Go ahead, Mr. Rivero. 


THE COURT: All right. Let's finish. 


MR. RIVERO: Judge, if we're going to have this kind 


of discussion about the actual the entire thing, because 
there is an entire context before. I have told the Court that 


I have instructed the client. I'm not opposed to an 


admonishment, Your Honor. But I don't know as I stand here 


right now that this other thing is connected. And, in fact, if 


we look at the statements before, Judge, he has a database 


litigation going on somewher lse and there's a discussion in 


the list of things before about the database issues and then 


the statement follows. 


I don't know, Your Honor, is what I'm saying. I don't 


know. I certainly don't know about this last statement. I'm 


not opposed to an admonishment, Your Honor. But if we're going 
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to go deeper into this, I would need time to figure it out. 


THE COURT: Well, let me put this to rest once and for 


all. And Mr. Freedman, you can certainly speak with Dr. Edman 


outside and if it has, in fact, had some type of ect, you 


can let the Court know. 


But absent that, let me state, Dr. Wright, that it's 


t this Court's function to monitor your public or private 


tivities, but to the extent that it does have a chilling 


Fect on witnesses and is a direct or indirect threat, then I 


do get involved. So I am letting you know, sir, that I am not 


going to tolerate that moving forward. 


To the extent that you choose to make any type of 


ther statement, as you've seen with regard to several of 


tatements, they were used for purposes of impeachment. And 


it's your decision. I certainly don't know of a lot of 


litigants that persist in publicly making statements throughout 


the course of the trial, but that's entirely your decision. 


And I'm not going to monitor those statements, other than 


statements that may have an effect on witnesses over the course 


re) this trial. 


Is that understood, sir? 

THE DEFENDANT: Yes, Your Honor. I wasn't trying to 
talk about this case and I wasn't trying to intimidate anyone 
here. 


THE COURT: Well, it certainly sounded like you were, 
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THE DEFENDANT: I'm sorry, Your Honor. 


THE COURT: So I'm letting you know, sir. 


Is there anything further? 


MR. FREEDMAN: Not from Plaintiffs, Your Honor. 


MR. RIVERO: Not from Defense. 
COURT: All right. Let's bring in the jury. 


where is Dr. Edman? 


MR. FREEDMAN: I'll get him. 


(Before the Jury, 11:55 a.m.) 


THE COURT: All right. Welcome back, Ladies 


Gentlemen. Please be seated. 


And welcome back, Dr. Edman. If you'll step forward 
to the witness chair and we'll continue with the testimony, 
Sir. 

(Pause in proceedings.) 


BY MR. ROCHE: 


Q. All right. I think before we left for the break bet 


we left for the break, we were looking at -- 
MR. ROCHE: Not yet to the jury. 518.3 and 518.4. 
BY MR. ROCHE: 


QO. What are those documents? 


A. They represent two PDF objects that I extracted from 518. 


MR. ROCHE: Your Honor, we wish to introduce 518.3 and 


518.4 into evidence. 
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MR. RIVERO: No objection, Your Honor. 


THE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 518.3 & 518.4 received into 
evidence. ) 
MR. ROCHE: If we could publish to the jury. 
If we could go to the next slide. 


BY MR. ROCHE: 


right. What do lines 16 through 17 in 518 -- and just 


a step back because -- what are Exhibits 518 and 514 


jury? 


is the October 17th, 2014 version of this particular 


document. And 514 is the purported June 24th, 2011. And 518.2 
is metadata corresponding to 518. And 514.1 is metadata 
corresponding to 514. 


Q. And let's look at the highlighted lines, lines 16 through 


17, in both 518.2 and 514.1. What's the significance of lines 


16 and 17 in the metadata for these two documents? 


A. It shows that the two documents have the same document ID 


but different instance IDs, which, again, indicates it's two 


versions of the same document. 


Q. Okay. And so the document ID is the number beginning 


75d61? 
A. That is correct. 


QO. And that's similar to the document IDs we looked at in 


relation to forgeries six and seven, correct? 
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A. Correct. 
QO. And so what does that tell us about how 518 and 514 were 


created? 


A. It suggests that the two documents are related. In 


particular, 514 is a revision of 518. 


Q. Okay. 

MR. ROCHE: And, Dorian, if we could go to the next 
slide, please. 
BY MR. ROCHE: 
Q. All right. Is there anything else noteworthy about the 
metadata for 514? And 514 -- can you just remind the jury 
which version of the PDF from Dave to Craig that is? 


A. 514 is the purported June 24th, 2011 version. Within 514, 


the metadata appears to have been modified. In particular, 


line 21, the mail date is different. 


Line 23 shows that the email was purportedly | 


dave@davekleiman.com. 


Line 25 shows that the email is still purportedly sent to 


craig@panopticrypt.com. 


And then in lines 26 through 28, the mail transport headers 
also appear to have been modified. In particular, a large 
portion of it has been deleted. 

Q. So there is —- what does 26 and 27 show about how it was 


manipulated? 


A. 26 through 28, a number of -—- or a large portion of 
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il transport headers have been removed. And in particular, 


in line 28, a "Date" field has been changed. 


Q. Okay. Is there anything significant about the date 
highlighted in line 28? 


A. The date in line 28, it's been changed to say: "Thursday, 


June 24th, 2011"; however, June 24th, 2011 was a Friday, not a 


Thursday. 


Q. So Thursday, June 24th, 2011 is not a real date in history? 


MR. RIVERO: Objection. Leading. 


THE COURT: Overruled. T'll allow that. 


THE WITNESS: Correct. 


BY MR. ROCHE: 


Q. We looked at a number of emails and PDFs. 514, 518, 


related to how Plaintiffs' Exhibit 35, forgery number eight, 
was created. Is there any other noteworthy documents that you 
have examined? 

A. Yes. 


MR. ROCHE: Dorian, if we could go to 538 which has 


been previously admitted into evidence. 

The next slide. I think it's on the next slide, 
Dorian. 

Thank you. 


BY MR. ROCHE: 


Q. Dr. Edman, what is Plaintiffs' Exhibit 538? 


A. 538 purports to be a native email file corresponding to 
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forgery number eight. 


Q. Okay. Do you know when this document was produced to 


Plaintiffs in the litigation? 


A. My understanding is this document was produced to 


Plaintiffs the night before a previous hearing in this matter. 


MR. RIVERO: Objection, Judge. 


MR. ROCHE: I'm not going to ask anything -- 
THE COURT: The objection is sustained. 
BY MR. ROCHE: 
Q. Dr. Edman, was there anything about 538 that suggests that 


it is also a forgery? 


A. Yes. 
MR. ROCHE: Let's bring up 538.2, 538.1. 
Take it down from the jury. 
BY MR. ROCHE: 
Dr. Edman, what's 538.1? 


538.1 shows the mail transport headers corresponding to 


And what is 538.2? 


538.2 is a conversion of a particular timestamp in 


MR. ROCHE: Your Honor, at this time, we move f 


538.1 and 538.2 to be admitted. 
MR. RIVERO: No objection, Your Honor. 


HE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 538.1 & 538.2 received into 
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evidence.) 

BY MR. ROCHE: 

Q. All right. Dr. Edman, let's start with 538.1. Did you 
extract this from 538? 

A. I did. 


Q. Can you walk through the jury -- with the jury your 


findings in relation to 538.1? 


A. Well, in 538.1, the mail transport headers, or at least the 
dates that are clearly days to a human looking through them, 


appear to correspond to June 23rd or June 24th, 2011, depending 


on the time zone. 


However, in line 3, at the end of line 3, there is another 


"Timestamp" field that's in a different format typically used 


by computers and may not necessarily be immediately 
recognizable to humans as a timestamp. 

Q. So -—- my bad. 

A. As I said, the timestamp in line 3, as shown in 538.2, 


actually corresponds to October 24th, 2012, as opposed to the 


human readable timestamps which correspond to a completely 


Fferent date. 


Okay. I want to -- so the red box, it's just a long string 


F numbers? 
A. Correct. 


Q. And what is —-- what is the -- can you explain what the 


Significance of that long string of numbers are as it relates 
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EO DS0c27 


t's a timestamp, but it's in a format typically used by 


CeErs. 


it difficult to recognize just based on the naked eye 


t's a timestamp? 


is. Unless you're familiar with that particular format. 


Q. Okay. So how does 538 compare to the other documents we 


_ 


looked at relating to forgery number eight? Specifically 514, 


518, how does 538 relate to those? 


A. It just appears to be another version. 


Q. Okay. Does it appear to be a better forgery than the 
others? 

MR. RIVERO: Objection. 

THE COURT: Sustained. 

Rephrase, please. 


BY MR. ROCHE: 


Q. Can you say anything concerning the degree of effort put 


into the manipulation in 538 compared to 514 and 518? 


A. This one definitely has a less obvious manipulation 


compared to the previous forgeries. 


MR. ROCHE: Dorian, could we go to the next slide, 
please. 


BY MR. ROCHE: 


Q. We've looked at a lot of documents related to forgery 


number eight, which is the purported email from Dave Kleiman 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 131 of 94 


Craig Wright attaching the Tulip Trust documentation. Can you 


walk the jury through the different versions that we're looking 


at on the screen of forgery number eight? So let's start with 


35, 514, 518, and then end at 538. 


A. Sure. So 35 was produced as a scan of a hard-copy document 


that purports to represent a June 24th, 2011 email. 


514 is an electronic version that is visually identical to 


P35, but contains metadata indicating it's been manipulated. 


518 is another version that is visually similar but has a 


different date. In particular, that one has an October 17th, 


2014 date and contains mail transport headers that indicate it 


_ 


was created from an email 


rom craig@panopticrypt.com to 


craig@panopticrypt.com on that date. 


And then separately, 538 is a native email file that 


purports to correspond to the documents on the left, but itself 


contains another indication that it has been manipulated. 
Q. All right. Thank you. 

MR. ROCHE: Dorian, could we go to the next slide, 
540, which has already been admitted into evidence. 


BY MR. ROCHE: 


Q. All right. Dr. Edman, we're looking at Plaintiffs' Exhibit 


540. Did you determine that 540 -- did you determine whether 
or not 540 is authentic? 


A. In my opinion, it is not. 


Q. All right. We'll refer to this as forgery number nine. 
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And what is the date the purported date of Plaintif 


Exhibit 540? 


A. April 2nd, 2013. 


Q. And that date -- is there anything significant about that 


date in relation to Dave Kleiman? 


A. It's purportedly shortly before his death. 


Q. Okay. I'll read the message. "Hello, good sir. I cannot 


do much right now, but I will accept a role as director of 


Coin-Exch. as we discussed. The contracts are done and we will 


use capital I have access to here. I will leave any dealing 


for the automation and banking software with you for the time 
being. I hope to see you in May, June as we discussed. It is 


good that you have engaged an accountant. Make sure Mr. Wilson 


is on top of it all. Respectfully, Dave." 


see the reference to Coin-Exch. Were you here during 


Wright's testimony about Coin-Exch.? 


was. 


Do you understand that shares in Coin-Exch. were of 


Plaintiff -—- 
MR. RIVERO: Objection -—- 
BY MR. ROCHE: 


Q. -—- by the Defendant? 


MR. RIVERO: Objection, Judge. Leading. It's his 
expert witness. 


THE COURT: Sustained. 
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BY MR. ROCHE: 


Q. Was there anything significant -- we'll move on. 


Dr. Edman, did you review the digital signature contained 
within Plaintiffs' Exhibit 540? 
A. I did. 
MR. ROCHE: Let's take down and put up 540.2. 


(Pause in proceedings.) 


MR. ROCHE: If we're having dif finding it, we 
can just show the slides. Just show 540. 
There we go. 


BY MR. ROCHE: 


Q. Dr. Edman, what is 540 -- 


MR. ROCHE: We had it. 


I'm sorry. If we can take this down { 
Okay. 
BY MR. ROCHE: 


Q. Dr. Edman, what is 540.2? 


A. This is my analysis of the cryptographic signature { 


540. 
Q. And what's 540.1? 


A. 540.1 is a PDF metadata object that I extracted from 540. 


Q. Okay. 
MR. ROCHE: Your Honor, we move to admit 540.1 and 
540.2 into evidence. 


MR. RIVERO: Without objection. 
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THE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 540.1 & 540.2 received into 


evidence.) 
MR. ROCHE: You can go to the next slide, please. 
BY MR. ROCHE: 


Q. All right. All right. We're starting with 540.2. I see 


the digital signature up there on the top left. Dr. Edman, can 


you walk us through the relationship between the digital 


Signature and 540.2? 


A. The cryptographic signature shown in the top left indicates 


that it was created October 22nd, 2014, as shown on line 35 on 


the box on the right. 

Q. Dr. Edman, when did Dave Kleiman die? 

A. I understand it was April 2013. 

Q. So about how long after Dave Kleiman died was this 
Signature created? 


A. About a year anda half. 


QO the key so earlier, we were talking about the keys 


used to sign digital signatures. Was the key in this -- used 


to sign this signature used in any of the other exhibits we've 


looked at today? 


A. It was used to create a signature that was attached to 


forgery number eight. 


Q. So the same key used in forgery number eight was used in 


forgery number nine? 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document:53-12 Date Filed: 11/30/2022 Page: 135 of g@54 


A. Correct. 


OQ. there anything else about forgery number nine that 


showed it was not authentic? 
A. 


MR. ROCHE: Dorian, if we could go to the next slide, 


I think -—- all right. We've got these all in 


evidence. 540.1 and then 514.1 and 518.2, which we looked at 


earlier in relation to forgery number eight. 


BY MR. ROCHE: 


Q. So let's look at line 16 to 17 in each of these. Can you 


walk the jury through what lines 16 to 17 show? 


A. Lines 16 and 17 shows that all three documents have the 


exact same document ID but different instance IDs, which, 


again, indicates that they are revisions of the same document. 


Q. So each of these three documents were created are 
revisions of each other? 
A. Correct. 

MR. ROCHE: Dorian, could we go to the next slide, 
please. 
BY MR. ROCHE: 


Q. All right. So we're looking at 518 -- so 518 and 514, the 


Tulip Trust, forgery number eight, and then 540, forgery number 


nine. Are there any other similarities between these three 


documents? 
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A. Yes. In the headers shown here, you can see they have the 


same "From," "To," "Subject," and "Importance" field. 540 
notably contains an "Attachments" field, even though it has no 


attachments. It appears they have just been deleted, but the 


£ 


"Header" field shown here was left remaining. 


Q. Would you expect an authentic email that had no attachments 


to display that? 


A. I would not. 


Q. And did you examine any other documents that Craig Wright 


swore were authentic and were relating to his Bitcoin holdings? 


A, J-dids 


MR. ROCHE: Dorian, if we could go to the next slide, 


please, which was previously admitted as Plaintiffs' Exhibit 


3.6. 
BY MR. ROCHE: 


Q. What is this document? 


A. This document is -- or purports to be a deed of trust 


between Wright International Investments, Ltd. and Tulip 


Trading, Ltd. dated October 23rd, 2012. 


Q. Were you here when Dr. Wright testified about this 
document? 

A. I was. 

Q. Let's read the text highlighted in Paragraph 3. 


COURTROOM DEPUTY: Mr. Roche, is this in evidence? 


MR. ROCHE: 36 is in evidence. 
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THE COURT: 536? 


MR. ROCHE: No, 36. 


THE COURT: 36. I believe it is, but let me just 


check for you. 


(Pause in proceedings.) 


THE COURT: Yes. It's in evidence. 


BY MR. ROCHE: 


Q. All right. So focusing back on Paragraph 3 from the deed 


of trust dated October 23rd, 2012. "All Bitcoin and associated 


ledger assets transferred into Tulip Trading by David Kleiman 


on Friday, 10th June 2011, following transfer to Mr. Kleiman 


from Dr. Wright on June 9th, 2011. This formalizes the 


transfer from Mr. Kleiman of the assets moved June 9th, 2011 


from Dr. Wright to the care of Mr. Kleiman. This includes the 


1.1 -- 1,100,111 Bitcoin held under the former arrangement and 


the attached conditions, the software license payments from 


casino gaming operations into Liberty Exchange." 


Dr. Edman, in your opinion, is the deed of trust between 


Wright International Investments and Tulip Trading, dated 


October 23rd, 2012, an authentic document? 


A. No. 


Q. Okay. We're going to refer to Plaintiffs' Exhibit 36 as 


_ 


forgery number 10, the final forgery. 


All right. Is there anything about the content of this 


document -- and remember, if we go back to the three analysis 
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modes you used from yesterday, the content, the metadata, and 


the cryptographic signatures -- is there anything about the 


content of this document that indicates it's a forgery? 


A. The fact that it is dated October 23rd, 2012 and references 


Tulip Trading, Ltd., which I understand was not purchased by 


the Defendant until October 2014. 


Okay. And did you review the metadata to this document? 
Lt did: 


All right. Before -—- 


MR. ROCHE: Let's take down from the jury, please. 


Let's bring up -- we'll do first 521 and the next -- 


oh, 521.1 and after that 521.7. 
BY MR. ROCHE: 


Dr. Edman, what is 521.17 


521.1 is metadata that I extracted from 521. 
Metadata you extracted from forgery number 10? 
Correct. The deed of trust. 


And what is 521.7? 


521.7 shows properties associated with a File that I 
extracted from 521. 
MR. ROCHE: Your Honor, we move to admit 521.1 and 
521.7 into evidence. 
MR. RIVERO: No objection. 
THE COURT: Admitted into evidence. 


(Plaintiffs' Exhibits 521.1 & 521.7 received into 
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evidence. ) 

MR. ROCHE: All right. Let's go back to the slides 
and let's go to 521.1. 
BY MR. ROCHE: 


Q. All right. What does the metadata for this document show? 


A. The metadata suggests this document was created October 


22nd, 2012 in zone UTC+11. It also indicates the author of 


this document was named "craig.wright. 


ut that date matches the deed of trust, right? 


t appears to. 


kay. Well, is there anything else that you reviewed to 


determine that this forgery number 10 is a forgery? 


A. Yes. 
MR. ROCHE: Let's go to the next slide. 
BY MR. ROCHE: 


Q. All right. I see on the right those annoying windows that 


pop up on my computer, and on the left the deed of trust. Can 


you explain to me what 521.7 shows? 


A. 521.7 shows properties associated with a File that I 


extracted from 521. In particular, that font file for a font 


called Calibri for Microsoft contains a copyright notice for 


Microsoft dated 2015. 


QO. So this is a font file contained within 536. 


MR. ROCHE: And I believe, Your Honor, we have the 


wrong exhibit number on the bottom there. 521 should be 36. 
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BY MR. ROCHE: 
Q. But can you confirm that -- 
MR. ROCHE: There we go. The Bates stamps match up. 


BY MR. ROCHE: 


Q. Dr. Edman, can you confirm that you extracted this 


file from forgery number 10? 
Yes. 
And do the Bates labels on there match up? 


Yes. 


So did you verify -- so it says: "Microsoft Copyright 


2015," which was later than the date this document was 


purportedly created. Did you verify that this font wasn't 


created by Microsoft until 2015? 


A. I did. I verified that the font contains a cryptographic 


signature created by Microsoft. That signature contained a 


timestamp and that timestamp indicated the signature was 
created in May or June of 2015. 

Q. So this font file didn't exist until at the earliest May, 
2000 -—- 

As 2015, 

MR. RIVERO: Objection. Leading. 


THE COURT: Overruled. 


BY MR. ROCHE: 
Q. Is it possible for a font file in a document to exist -- 


let me -- is it possible for a font dated in 2015 to exist ina 
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document that's purportedly created in 2012? 


A. No. 
MR. ROCHE: Dorian, if we could go to the next slide. 


BY MR. ROCHE: 


Q. All right. Did you find any other f files contained in 


forgery number 10? 


A. I did, yes. 


Q. And can you walk the jury through those four font files? 


_ 


A. Sure. Each of those font files contained cryptographic 


Signatures from Microsoft dated in 2015. Additionally, the 


properties associated with those font files contained copyright 


notices from either Microsoft or the Monotype Corporation, all 


of which were also dated 2015. 


Q. Dr. Edman, what do the five font files found in forgery 


number 10 tell us about Plaintiffs' Exhibit 36? 


A. It suggests it was not created until at least mid 2015. 
MR. ROCHE: Dorian, you can take those slides down. 


BY MR. ROCHE: 


Q. Dr. Edman, we've looked at a lot of documents this morning 
and yesterday. 


Besides the 10 forgeries we've walked the jury through this 


morning and yesterday afternoon, did you examine any other 


documents in this case that were produced by the Defendant? 
A. I did. 


Q. Were there other examples of forgeries produced by the 
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fendant in this case? 


A. There were. 


Q. And approximately how many additional forgeries did you 


find? 


A. I'd estimate about 25 to 30. 


Q. Okay. For the 10 forgeries we've written up there and 


we've shown the jury today, is there any doubt in your mind 


that those documents are not authentic and are, in fact, 


forgeries? 


MR. ROCHE: No further questions at this time, Your 


THE COURT: Cross-examination. 
MR. ROCHE: Wait. Hold on. 
THE COURT: All right. Certainly. 
(Pause in proceedings.) 
MR. ROCHE: One final question, Your Honor. 
BY MR. ROCHE: 


Q. Dr. Edman, are all of the opinions you've given to the 


this morning given within a reasonable degree of certainty f 


an expert in your field? 
A. In my opinion, yes. 
MR. ROCHE: No further questions at this time. 


THE COURT: All right. Cross-examination. 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 143 of 364 


CROSS—-EXAMINATION 
BY MR. RIVERO: 


Q. Good afternoon, sir. 


— 


Good afternoon. 


Q. Dr. Edman, you're not here to give testimony about whether 


or not there was a business partnership between Dr. Wright and 
David Kleiman to avoid -- I'm sorry -- to invent and mine 
Bitcoin, correct? 

A. That is correct. 


Sir, you have three degrees in computer science? 


at is correct. 
d your masters focused on applied cryptography and 
anonymous communication systems, right? 


at is correct. 


d your Ph.D. studies focused on computer security and 


especially wireless security? 


A. Correct. 


Q. And, sir, the degrees are in computer science; isn't that 


right? 


A. That is correct. 
Q. So you're a computer scientist? 


A. I suppose you could say that, sure. 


Q. Well, the degree itself has the word science in it, doesn't 
it? 


A. It does. 
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right. So sir, in what your -- in your field, what you 
obviously apply the scientific method, right? 

I believe so. 
know what the scientific method is, right? 


In general. 


I'm sorry? 


Yes. 


So sir, I just want to take you through this because I have 


a ninth-grade biology understanding of the scientific method 
and I think you can help us all. You're an expert. 


The scientific method is that, first, you, as a scientist, 


would observe some events or conditions, some -- what might be 


called in science some phenomenon, right? 

A. OkKay. Sure. 

Q. Okay. And then you would make a theory about what -—- how 
that phenomenon works; isn't that right? Isn't that where you 
start? 


A. Yes. 


Q. And that's called -- in science, that's called a 
hypothesis, right? 

A. Yes. 

Q. So then --— that's step one. Step two, you would take that 


hypothesis and as a scientist, you would make certain 


predictions and a theory, and you would say: "If this theory 


is true, then I expect that A, B or C would happen." Isn't 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 145 of 354 


that the second step? 
A. I suppose, yes. 
Q. Well, sir, it's not a matter of supposing. I mean, I'm 


talking about the scientific method. You do understand what 


I'm talking about, right? 
A. I do. 


Q. So isn't it critical that for a scientist, you would say: 


"This is my theory and this is" -- "if my theory is right, this 
would happen and that would happen and that would happen"? 
Right? 

A. 


Q. Then what you would do is very important, step three, to 


make it science, is you would do something to test your theory. 


Right? 
Yes. 
And that's what we call experimentation, right? 


Yes. 


Okay. And that experimentation in the scientific method 


has certain characteristics, you would agree. Like, for 
example, you would control the variables to make sure that 
you're testing what you think you are testing, right? 


A. Yes. 


Q. Okay. So there's the third step would be to experiment, 
to test, right? 


A. Yes. 
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Q. And then the fourth step is: Once you've experimented, the 


experiment either shows that what you have theorized tends to 


be confirmed or is disproved, or tends to be disproved, right? 


this fourth part is -- is what in science is called a 


Correct? 


would you agree with me that in science, as opposed to 


religion or philosophy or other ways of thinking -- in science, 


it's always a theory that keeps being confirmed by experiments 


until perhaps some day it's disproved. Isn't that what science 
is? 
A. I suppose that's a general description, yes. 


Q. Okay. Now, sir, I won't belabor it, but to take a very 


common example that we might use as just normal people in every 


day, if you wake up in the morning -- posing a hypothetical -- 


and you plug your coffeemaker in and you push the button and it 
doesn't work, you might form the hypothesis that the 
coffeemaker is broken, right? 

A. You might. 


Q. And if we were doing the scientific method, we'd say: 


"Well, if the coffeemaker" or you might have another idea. 


You might say: "Or the outlet doesn't work," right? 


A. Sure. 


Q. Okay. And if you wanted to, if you said: "Well, if 
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outlet doesn't work," you might predict: "Well, another 


appliance, if I plug it in, that won't work either." That 


would be a prediction based on one hypothesis about what's 
going on, right? 

A. 

Q. And then, as an experiment, you might then plug in the 
toaster, and you would see that either the toaster works or it 
doesn't work, right? 

A. Correct. 

Q. And if it works, then that would tend to disprove your 


hypothesis that the outlet is messed up and might make you 


think: "Let me look at the coffeemaker," right? 
A. Yes. 


Q. Okay. Now, you never took a course related in your studies 


to determining whether a document is a forgery because there's 


no such course at the schools you attended, correct? 


A. Not to my knowledge, true. 


Q. And you have never published any papers related to forensic 


analysis of documents, right? 
A. I have not. 


Q. And you have never given any presentations related to the 


forensic analysis of documents, correct? 


A. I have not. 


Q. And prior to this case, sir, have you ever testified ina 


_ 


federal trial on forensic analysis of documents like this, what 
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you have given today? 
A. Yeah. I believe so. 


Q. Okay. And when was that, sir? 


A. I don't recall exactly. I would estimate that that was 


probably 2017. 


Q. All right. So you say you have one other instance where 
you have given such testimony? 


A. To the best of my recollection, yes. 


Q. All right. You worked on the Silk Road case, correct? 


Ae 1 -dads. 


Q. And you supported and provided consulting services related 


to the seizure of Bitcoin in the Silk Road case, right? 
As Lf ‘dad, 
Q. Silk Road -- this was brought up on direct -- Silk Road was 


a dark website that involved illegal activities; isn't that 


right? 
A. 


Q. And so, on Silk Road, there would be all kinds of illegal 


activities, some of them terrible, sale of illegal weapons; 


isn't that right? 


A. No. I mean, to the best of my recollection, Silk Road did 


have there were certain things that Silk Road would not 
allow you to transact in. Weapons, they created actually a 


separate website for that called "The Armory." Child 


pornography was another thing that Silk Road prohibited you 
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from transacting with. 


Q. Did Mr. Ulbricht create other websites to allow the 


transaction in child pornography? 


MR. ROCHE: Objection. Relevance. Beyond the scope 


RIVERO: Your Honor, this was brought up on 
direct. 
THE COURT: With regard to other websites, the 
objection is sustained. 


BY MR. RIVERO: 


Q. Bitcoin was important to the operation of Silk Road; isn't 


that right? 
MR. ROCHE: Objection. Speculation. Outside the 
scope of his 


THE COURT: If the witness knows. Overruled. 


THE WITNESS: To my knowledge, that was the only 


currency accepted on Silk Road. So yes, I would agree with 


that. 


BY MR. RIVERO: 


Q. The key person behind Silk Road, you were asked on direct, 


was Ross Ulbricht, right? 
Correct. 
And he went by the nickname the Dread Pirate Roberts? 
He did. 


And you worked on the prosecution? 
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A. I supported the prosecution. 


Q. Did you ever learn that Mr. Ulbricht had hired an expert 


named Andreas Antonopoulos to help him in his defense? 


MR. ROCHE: Objection. Relevance. Outside the 


HE COURT: Sustained. 


BY MR. RIVERO: 


Q. Now, sir, with regard to the forensic examination of 


documents, you have a single certification in that subject, 


right? 


A. It's a certification related to digital forensics. 


Q. That's the AccessData Certified Examiner? 


A. Correct. 


Q. Now, you're familiar with an organization called SANS, 
S-A-N-S? 


A. I am. 


Q. That's an organization that certifi Forensic examiners, 


correct? 


A. There are a number of such organizations, yes. But that 


one of them. 
And you don't have a SANS certificate? 


I do not. 


And you're familiar with GIAC? 


I am. 


And that's also an organization that certifi Forensic 


examiners? 
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A. To the best of my recollection, yes. 


Q. And you don't have any GIAC certifications, right? 


A. I do not. 


Q. And are you familiar with the EnCase, E-N-C-A-S-E 


don't know how to pronounce this, but it's EnCE, or E-N-C-E, 
certification? Do you know what I'm talking about? 


A. I do. 


Q. And that's the most widely used and accepted forensic 


certification, right? 


A. I have no idea. 


Q. You don't have an EnCase EnCE certification, do you? 


A. We don't use EnCase in my practice, so no, I don't. 
Q. Now, you're aware that Dr. Wright has over 45 computer 
certifications, right? 

MR. ROCHE: Objection. Relevance. 

THE COURT: Sustained. 


BY MR. RIVERO: 


Q. Sir, you're aware that David Kleiman had many of 


certifications? 
MR. ROCHE: Objection. Relevance. 


HE COURT: Sustained. 


BY MR. RIVERO: 


Q. Sir, you told the jury that your time is paid at $560 an 


hour, correct? 


A. Correct. 
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You said it was being paid to your company, correct? 

Correct. 

All right. And in your company, what is your title? 

I'm a director. 

You're a director. That's at a certain level in the 
company, I assume. You don't start as a director? 


As I -dad. 


Q. Right. But one doesn't come in and start out from day one 
as a director, I assume? 


As 1 -dad. 


Q. I understand, sir. Coming out of school, you wouldn't come 
in as a director, would you? 


As - did. 


Q. You had other experience before you went to your company. 
You worked at MITRE, didn't you? 


As -:L gad. 


Q. All right. So you didn't go straight out of school to 


become a director at your company? 


A. BRG was not my first employer directly out of school, but I 


did not hold any other positions at BRG since graduating 


school. 


Q. Now, BRG, Berkeley Research Group, has been paid for your 
work in this case, correct? The company you are a director at. 


Yes. 


And BRG has received more than $125,000 for your work on 
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this case? 


A. I honestly don't know how much BRG has received in total. 


Q. Did you -- were you -- have you reviewed the invoices 


provided starting on July 16, 2019 in this case? 


A. I think I would have reviewed them before they went out. 


Q. Right. So you don't recall that there was a July 16, 2019 


invoice that -- for your time that taled $28,000 -- more than 


$28,000? 


A. Not specifically, but I believe there probably was such an 
invoice. 


Q. And you don't remember that by August, the next month, you 


billed $16,000 -- more than $16,000 for your time? 


A. Again, I don't recall the specific amounts, but it seems 
plausible. 
Q. Sir, did you start working sometime in 2019 on this case? 


A. To the best of my recollection, yes. 


Q. All right. And you've been deeply in this case since at 


least the middle of 2019, correct? 


A. I don't know if I'd say deeply. Certainly, the work kind 


of comes and goes as the case progresses. 


Q. Sir, you've been I've observed that you're sitting here 


in the audience. And can you tell us how many of the days of 


this trial have you been sitting here? 


A. I believe I was here for half of last Monday, all of last 


Tuesday, and then the first half of Wednesday. I was also here 
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yesterday. 


Q. And you hadn't been here before that in the trial? 

A. No. I don't believe so. 

Q. All right. Sir, in this case, you're not -- I want to just 
define the scope of what your testimony is. You are not 
testifying about any partnership between David Kleiman and 
Craig Wright, correct? 


A. That is correct. 


Q. You're not -- you are not testifying about whether there 


was any fraud in this case; isn't that right? 


A. That is correct. 


Q. You are not testifying about the motivations for any change 


to any document in this case? 

A. I am not. 

Q. And you have no opinion to give about anything to do with 
who invented Bitcoin? 

A. That is correct. 


Q. You don't have any opinion to give about who has mined 


Bitcoin? 


A. That is correct. 


Q. You don't have an opinion to give on any valuation of 


Bitcoin? 
A. That is also correct. 
Q. And you don't have any opinion to give on whether 


Wright took anything from Dr. -- from David Kleiman; isn't 
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that right? 


A. That is also correct. 


Q. The issue that you're here the question that you're 


testifying about is the authenticity versus the 


£ 


certain documents; isn't that correct? 


non-authenticity o 


A. That is correct. 


Q. And as to the documents that you opine there are 


authenticity issues, you have used in the course of this 


proceeding -- sir, in the course of this proceeding, you've 


=e 


testified now four times in deposition, right? 


A. I don't believe so. I think it was -—- I think I was 
deposed three times, and then testified at a previous hearing 


in this matter once. 


Q. You've testified at a hearing and, in your recollection, 
three depositions, right? 
That is correct, I believe. 


And you have given declarations in this case? 


Yes. Declaration affidavits. 


Okay. And so you have taken oaths to tell the truth here 


many times in this proceeding on testimony, right? 


A. I have. 
Q. And what you said in your various reports and your 


testimony, sometimes you say these documents -- today, you used 


the word "forgery," right? 


A. Yes. 
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Q. Let me correct that. Today, Plaintiffs' counsel used the 


word forgery with you as to these documents, correct? 


A. Correct. 


Q. But at other times you've described these documents as 
manipulated, correct? 
A. Correct. 


Q. At other times you have described these documents as 


altered; isn't that right? 

A. Correct. 

Q. And at other times, talking about the same documents, 
you've called them modified, correct? 


A. Correct. 


Q. And so the jury can understand your opinion clearly, all of 


those four words, you agree they are they have the same 
meaning? They're all synonymous? 

A. In this context, yes, I believe so. 

Q. All right. And you are not opining as to the motivations 


behind any alteration? 


A. Correct. 

Q. And you're not giving any opinion as to whether -- you 
don't have an opinion to give whether Dr. Wright is credible, 
do you? 


A. No. 


Q. And you're not giving any opinion about Dr. Wright's 


character; isn't that right? 
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A. That is correct. 


Q. And you are not offering any opinion about whether any 


purported document manipulation constitutes fraud, are you? 
A. I am not. 

Q. You have no personal knowledge about who manipulated any 
document in this case? 

A. I have no personal knowledge other than based on the 
evidence that I've seen from the documents that I reviewed. 


Q. You cannot say with certainty that it was Dr. Wright who, 


in fact, manipulated any one -- particular one of these 
documents? 


A. I can't say with absolute certainty that he is the one. 


mean, Obviously there's a number of pieces of circumstantial 


evidence that suggest he did. But you are correct. I can't 


say with one hundred percent certainty that the Defendant did. 


Q. Now, it's your opinion -- you say -- today I think you said 


that you have analyzed these 10 documents plus 25 to 30 others. 


Let me restate that to make sure that we're clear. 


A. Thank you. 
Q. That you have arrived at an opinion on these ten plus 25 to 


30, is I believe what you said on direct. 


A. To the best of my recollection, yes. I don't recall the 
exact number. 
Q. Okay. And I'm going to ask you because I'm not clear, 


Dr. Edman. Have you opined about 50 documents or about 40 
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documents? 
A. I -- again, I don't recall the exact number. That sounds 


like about the number of documents that I've opined on the 


authenticity. But certainly in my review of certain documents 


to determine their authenticity, there are related documents 


that I would have also looked at. 


Q. And on these documents that we're talking about -- for 
example, today, to be clear, the document -- I'm not talking 
about the related documents. Those are metadata documents or 
other documents you compared. There's a central document in 
each of these examples that's the one you're opining about, so 
we had 10 examples today. Do you understand what I'm saying? 


A. I do. 


Q. All right. And you think that number is 40. Is that 


35 to 40 is your belief? 


A. Yeah, to the best of my recollection. 


Q. Could it be as high as 50? Do you remember? 


A. I suppose. Again, I don't recall specifically. 


Q. Now, it's your opinion that almost all of the documents 


that you have looked at, you think those documents were created 


for the most part in 2014, but there's some you say were in 


2015, right? 


A. It appears so. 


Q. All right. You're basing your opinion on artifacts related 


to the metadata and other characteristics of the digital 
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documents like cryptographic signatures, correct? 


A. Yes. 


QO. And document metadata that has been altered doesn't 


necessarily tell you who exactly did the alteration; isn't that 
right? 


A. Sometimes it contains indicators, but I would agree that it 


doesn't definitively tell you who did the alteration. 


Q. Now, you say that the manipulations are consistent with 


them having been done by Dr. Wright, correct? 
A. 


Q. But sir, in science, would you agree with me that because 


something is consistent doesn't mean, in fact, that the thing 
happened that way? 
A. I would. 


Q. And you're familiar with the expression: "Correlation is 


not causation." This is a scientific concept, is it not? 


A. I've certainly heard the phrase before, yes. 


Q. You would agree with me that if I said to you that in my 


experience when I sneeze, it rains, even if I observed that 


correlation, that doesn't mean my sneeze is the cause of the 
rain, does it? 
A. Certainly not from one sneeze. 


Q. Okay. When you say that the manipulations were consistent 


with having been made by Dr. Wright, one of the things you say 


is that you believe Dr. Wright had the means to do the 
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manipulation, correct? 


A. I would believe so, yes. 


Q. But you also agree, sir, that the fact that he had the 


ability to do something is not proof that he did it? 


A. I would agree. 
Q. For example, someone can have hacking tools, but not have 
used them for unauthorized purposes, right? 


A. I would agree. 


Q. And you, sir, have not taken any steps to determine whether 


anyone else had the means to make the document manipulations 


that you have identified here in court or the ones in your 


report; isn't that right? 


A. I believe that's a different question than what I was asked 


to do originally, which was just to determine whether or not 


these documents are authentic. 


I believe that determining exactly who created the 


documents, that's a very different line of inquiry and would 


require, you know, access to likely certain evidence that I did 


not in the course of this investigation. And I was also not 


asked to determine exactly who created these forgeries. 


Q. Fair enough. So there's two different questions. One is: 


Were the documents manipulated? There, you were clear that you 


were asked about that, right? 


A. I was. 


Q. But then there's a second part, this question of 
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consistency of -—- you say of some evidence with Dr. Wright, but 


were you asked to determine that or not? 


A. To the best of my recollection, I was asked for my opinion, 


but I wasn't asked to definitively opine as to exactly who was 
responsible for the forgeries. 


Q. I'm sorry. I don't mean to step on your answer. 


As a result of not being asked, you didn't, therefore, take 


_ 


steps to try to, for example, eliminate other possible -- let's 


call them suspects? 


A. Correct. Again, that was -- that's Fferent line 


f inquiry. 
You weren't asked to do that? 


I was not. 


Okay. So, for example, if, sir, I -- let's hypothetically 


say that on document -- I think it was Plaintiffs' 807. 


MR. RIVERO: And I don't know, Mr. Shah, if you have 


807 available. 


BY MR. RIVERO: 
Q. But on 807, it was example number six, altered document 
number Six. 


MR. RIVERO: Let's see if we can show that. 


It's in evidence. You can show the jury. 


BY MR. RIVERO: 


Q. Do you remember looking at this document with Plaintif 


counsel? 
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Q. And do you remember testifying that this document, in your 


opinion, is altered? 


A. I do, yes. 


Q. Yeah. Now, sir, if I'm able to demonstrate, for example, 


through my expert that the IP address that you referred to in 


number six I believe that was from document 856.2. 


MR. RIVERO: Mr. Shah, I don't know if you have access 


to 856.2. Can you show that to remind the jury. 


Hmm. I may have gotten the number wrong, sir. But —- 
no, I don't think I did. 
BY MR. RIVERO: 
Q. Do you see that there's a number in the middle —- 

MR. RIVERO: Mr. Shah, if you could highlight under 
"TIP addresses" and draw out 58.160.32.123. 
BY MR. RIVERO: 
Q. Can you see that? 

MR. RIVERO: Can you pull it out, Mr. Shah, and make 
that big. 
BY MR. RIVERO: 


Q. That number there, sir, that IP address, goes to -- does 


that go to a certain device or does it go to a certain server? 


What does that mean? 
A. It depends on the configuration of that device. An IP 


address could represent a single device or it could represent a 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 163 of 2&4 


group of devices. 

Q. Okay. Sir, you didn't do anything -- you didn't go behind 
this -- you had this, right? You had this document? 

A. Correct. 

Q. You had it with squares and lines and all in red when 
Plaintiffs' counsel talked to you about that. Do you remember 
that? 

A. do. 

Q. Did you do anything to find out what IP address 


58.160.32.123 ties back into? 


A. Aside from this particular lookup, no, not to my 


recollection. 


Q. What you did was you showed the jury that one document was 
showing -- had this IP address. And then this other document 
had that IP address. Do you remember that? 


A. I do. 


Q. Yeah. But you didn't do anything to find out whose IP 


address, or who that might be tied to, right? 


A. I don't believe I would have had the ability. Typically, 


to identify the subscriber or the individual or organization 


associated with an IP address, in my experience from supporting 
law enforcement investigations, you generally need a subpoena 
to the ISP and then they can provide current and historical 


records. I don't have the ability to issue a subpoena. 


Q. You weren't able to get behind that IP address, right? 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 164 of p64 


Correct. 
Okay. And you didn't try to? 
Again, I don't believe I had the ability to. 


Well, sir, you didn't have subpoena power, right? 


As far as I know, sir, I don't. 
MR. ROCHE: Objection -- 
BY MR. RIVERO: 


Q. But you know that Plaintiffs' counsel -- 


HE COURT: Hold on. What's the basis of 


objection? 
MR. ROCHE: Relevance. 


HE COURT: Overruled. 


BY MR. RIVERO: 

Q. You know Plaintiffs' counsel had subpoena power in the 
case, right? 

A. Honestly, I don't. 

Q. Okay, sir. So you don't know they could have gone and 
asked to find out what this address was? That's what you're 


saying? 


MR. ROCHE: Objection. Asking for a legal conclusion. 


THE COURT: Overruled. 


THE WITNESS: No. I didn't know if they did or did 


not have that ability. 
BY MR. RIVERO: 


Q. Sir, Wooloowin, Queensland, Australia, that's a location 
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that's shown on here, right? 
A. It is. 


QO. And that has some association with this -- it's shown in 


this metadata or GeoIP Precision lookup form? 
MR. RIVERO: If you can show the entire document. 
BY MR. RIVERO: 


Q. Right? It has some relationship, right? 


A. It does. 

Q. Did you look at a map to see where Wooloowin, Queensland, 
Australia is? 

A. I believe so. 


Q. Okay. And when you saw that, did you learn that it was 


2,000 miles away from where Dr. Craig Wright lived? 


A. No. Because, again, the GeoIP address provides you an 


approximate geographic location. I certainly wasn't relying on 


specifically that IP address being associated with Wooloowin. 


But my understanding is that Queensland, Australia is 


consistent with Eastern Australia. 


Q. You know Australia is a continent, right? 
aware, sir. 


you know it's a very big country? 


well aware, sir. 
so you don't know —- you can't tell the jury where 


Wooloowin is in relation, for example, to Bagnoo or wherever 


Dr. Wright lived at this time? 
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A. I don't know what Bagnoo is. But no, I can't. 
MR. RIVERO: May I have one moment, Judge? 
THE COURT: Certainly. 
(Pause in proceedings.) 
BY MR. RIVERO: 


Q. So, sir, I just want to be clear. 


MR. RIVERO: If you could put that document back up, 
Mr. Shah. I don't know why it's down. 

I'm sorry. It's 656.2. 
BY MR. RIVERO: 
Q. I just want to be clear. For the moment, leaving aside the 


detail of the IP address and the rest, you didn't check to see 


if Wooloowin is more than a thousand kilometers away from where 
Wright was living at this time. You didn't look at a map 
determine that, right? 

A. I did not. 


Q. You didn't do anything to determine whether this IP address 


tied into any specific device, correct? 
A. Correct. 


Q. And, sir, what you did in all -- in every instance -- in 


every instance, what you did was you simply looked at what 


either the metadata shows or what the cryptographic signature 


shows, or what you call the human readable content shows. 


That's what you looked at? 


A. As well as the internal structure of the documents in some 
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instances. 


QO. Internal structure of the document. 


Okay. Sir, the the I'm sorry that -- my next 


question is escaping me, sir. It doesn't happen so often. 
I'll try to remember what it was. 

Oh, but you certainly didn't do -- in this instance, you 
didn't go beyond the structure of the document, what you could 
read of the document, what the metadata attached to the 
document. All -—- what you looked at was everything around that 


digital document, right? 


A. In some instances, I would compare artifacts from the 
electronic document to third-party sources, such as the GeolIP2 
lookup. 


Q. Oh, the GeoIP. I wanted to ask you about that. Isn't it 


the case that this GeoIP Precision lookup form, number one, it 


has at least -- isn't it true it has two significant flaws? It 


od 


is a tool to use for the purpose of figuring out where a 


digital document came from. Isn't it true there are two 


Significant flaws? 


A. Perhaps. I'm sure you're going to tell me what those two 


flaws are. 


Q. Well, sir, wait a minute. I don't have a Ph.D. in computer 


science, so I'm asking you: Isn't it true there are two 


significant flaws and you have testified about at least one of 


them? 
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A. Possibly. I don't recall specifically. 


Q. Sir, let me ask you: Don't you know? Because I see in 


this analysis stuff you go back and you go back and you look at 


Bi ox — 


where fonts come from, when they were copyrighted, and this 


kind of thing, right? 
A. Ido. 
Q. So I assume that you have checked out the user instructions 


on GeoIP, have you not? 


A. I have, I'm sure, at some point. I'm familiar with the 


service. 


Q. Let's be real clear. When you use GeoIP when did you do 
the search? When did you do the lookup? 

A. This was 2019. 

Q. What it gives you is the GeoIP location at the time you 
look it up; isn't that right? 


A. In this case, it does, yes. 


Q. And it doesn't give you a historical analysis of where the 


GeoIP where the I'm going to get lost in jargon. It 


doesn't tell you where that came from at an earlier time, 
right? 


A. So in the context of the GeoIP Precision service, which 


MaxMind markets as its most up-to-date and most accurate 


service, you're correct. They advertise it as most accurate, 


but it does not provide historical information. 


I recall you asked me about this at one of my depositions. 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 169 of 24 


Subsequent to that, I was able to access historical databases 


for not this GeoIP2 Precision service, but it was a GeolIP2 City 


service. 
Q. Sir -- 


MR. ROCHE: Please let him finish the -- 


THE COURT: Has the witness finished his answer? 


THE WITNESS: No. 


THE COURT: All right. You may finish your answer, 


HE WITNESS: According to this separate GeoIP2 City 


database, the results were consistent with what's shown in 


GeoIP2 in the lookup form here, which is Eastern Australia. 


BY MR. RIVERO: 


Q. Sir, let me go back to what we were talking about. 


First of all, sir, I have never examined you before; isn't 
that true? 


A. No. I believe it was always Mr. Kass. 


Q. Right. So sir, I'm asking about what -- this evidence that 


you are showing the jury and that counsel has shown the jury is 


from this GeoIP2 Precision lookup form, correct? 


A. It is. 


Q. And that the information that you presented in front of the 


jury gives you the current state of the -- of where the device 


would be located now; isn't that true? 


A. As of the time that the lookup was performed. 
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Q. Thank you. So in other words, if you looked at it in 2019, 


it would tell you in 2019, correct? 

A. That is correct. 

Q. And it would not tell you where this device -—- this would 
not tell you where this device was in 2014? 


A. No. Again, it doesn't provide historical access to this 


database. 


Q. And I understand you're trying to volunteer some other 


information about something. Let me ask you, sir: This 


information you're volunteering, that's not found in your 


expert report, is it? 


A. It is not. This was subsequent to one of my depositions. 


Q. Yeah. And sir, in other words, I could put out your four 


expert reports here, and I would never find that testimony that 


you just gave this jury anywhere in those reports, would I? 


Ais t is true. 


Q. And we could look at your four testimonies before today and 


we would never see that, would we? 


A. That's true. 


Q. Now, sir, isn't it the case that in many instances in these 


documents -- well, let me just be precise about this -- 
MR. RIVERO: And, Judge, I can continue or stop 
whenever the Court prefers. 
THE COURT: Is this a good time to stop? 


MR. RIVERO: If you don't mind, I'll just ask a sort 
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fF closing-up question on that. 


MR. RIVERO: 


Q. Sir, you didn't do anything to go outside of the documents, 


other than you say you went to something like another computer 


source, to determine whether the real-life events described in 
a document happened; isn't that right? 
A. Correct. 


Q. Okay. So your analysis was limited to looking at the 


digital information; isn't that right? 


A. It was, yes, limited to looking at digital information. 


MR. RIVERO: Your Honor, that's a good stopping place. 


THE COURT: All right. Ladies and Gentlemen, let's 


take a recess for lunch. I'll see you back here at 2:00. 


(Jury not present, 1:01 p.m.) 
THE COURT: Okay. Have a pleasant lunch. I'll see 
you back here at 2:00. 
(Recess from 1:01 p.m to 2:00 p.m.) 


THE COURT: Welcome back. I trust everyone had a nice 


We're waiting for Mr. Rivero and then we're ready to 
right. 

Mr. Rivero, are you ready to proceed? 

MR. RIVERO: Yes, Your Honor. 


THE COURT: Are the Plaintiffs ready to proceed? 


MR. FREEDMAN: We have two housekeeping matters. 
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First, your Honor, we believe that after Dr. Edman is done 


testifying the Plaintiffs will rest their case. Before we do 


that, though, we want to make sure our list of admitted 


exhibits matches the Court's. 
THE COURT: All right. 


MR. FREEDMAN: We don't think that has to be done 


before. So if the Court's okay with it, we'll announce that we 


rest and that will be understood that is subject to confirming 
that those in fact match. 


HE COURT: All right. Is that acceptable, that we'll 


do that outside the presence of the jury? 


MR. RIVERO: Yes, Your Honor. 


THE COURT: All right. Can we also take up any 


tions at the appropriate time and can we proceed right to the 


fendant's case? 
MR. RIVERO: Judge, we had a question how the Court 


wanted to address that. I don't know if we've I believe 


we'll be filing a motion at the close of the Plaintiffs' case 


and we don't know the timing that the Court would want to hear 
that. 


THE COURT: So for purposes of preserving, you can 


just state that you have a motion. It's preserved for the 


record. Then we can address it at the appropriate time. 


What I want to do is make use of the jury's time. So 


following Dr. Edman's testimony, and I'm not certain how much 
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longer you have for cross or any redirect, but I suspect that 


we will have some time this afternoon for the Defendant to 
present his case. 

MR. RIVERO: We will be ready to go, Judge. 

MR. ROCHE: Your Honor, one more matter. 

On the cross-examination -- and I just want to bring 


this up now so we don't waste the jury's time later. During 


the cross-examination Mr. Rivero asked a number of questions 
relating to the billings that Dr. Edman did during the 


preparation for and leading up to the June 28th hearing in 


front of Honorable Reinhart. I do think at this point it has 


opened the door to a line of questioning concerning the 


procedural history and the posture of this case. 


MR. RIVERO: Your Honor, absolutely not. What I asked 


was whether there was an amount as to one invoice. There was 


an amount to another invoice. I didn't show the invoices. 


made no reference to the purpose, and it was relatively brief 


Judge. It was only to establish the amount that the company 
had been paid on his behalf. I absolutely did not go into the 
subject -- 

MR. FREEDMAN: I believe the quote was "deep in this 
case." So I do think the jury -- I do think that opens the 
door for the jury understanding why Dr. Edman was doing work 
deep in this case going back to June 2019. 


THE COURT: Well, let me ask you, Mr. Roche. What is 
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t you're intending to introduce? Dr. Edman coming into 


to testify? 


MR. ROCHE: I would ask for forgeries number six and 
number seven, that he has previously submitted evidence to the 
Court that forgeries six and seven were submitted in this case. 
That's it. 


THE COURT: All right. The expert's time and the 


expense as a result of that time is certainly relevant. If 


want to inquire with regard to the specifics of the time 


without reference to any particular hearing, for example, 


Dr. Edman was required to testify during any pretrial 


proceeding that may have necessitated a significant amount of 
time, then you're free to ask that on redirect, but not with 


regard to the specifics of the pretrial hearing. 


MR. ROCHE: And I just want to -- the only question I 
wanted to ask, then, is with respect to the time in June 2019 
was that related to an analysis of two documents that were 


submitted in this litigation, forgeries six and seven. 


THE COURT: Well, I think all of his time is spent 


oF st 


analyzing documents. If you want to focus on time spent 


analyzing certain documents more than others -- 
MR. ROCHE: Okay. 


THE COURT: -- and that's consistent with the time 


records, but again, I don't want any reference to any pretrial 


proceedings. If his testimony was necessary before Judge 
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Reinhart, then you can certainly say: "And at some point in 


_ 


time did you testify and did you also incur expenses?" That 


would be the extent of it. Not why he testified, where he 
testified, and for what reason. 
Okay. We have clarification? 
MR. ROCHE: Yes, Your Honor. Thank you. 
THE COURT: Let's bring in the jury. 
(Before the Jury, 2:02 p.m.) 


THE COURT: All right. Welcome back, Ladies and 


Gentlemen. Please be seated. 
I trust you had a pleasant lunch and are ready to get 


back to work. 


We will continue with the questioning of 
CROSS—-EXAMINATION 
BY MR. RIVERO: 
Q. Dr. Edman, I had mentioned two flaws in the GeoIP site, and 
we had discussed one. I will come back to the other in the 


course of the examination. 


What I wanted to ask you now was on the subject of whether 


you had done anything to determine whether anybody else had the 
means to make the document manipulations that you have 
identified. One of the bases, sir, for believing that the 


manipulations are consistent with having been done by 


Dr. Wright is because of certain time zones associated with 


Australia, correct? 
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A. Correct. 


Q. Now, sir, you would agree with me that with regard to 


computer time zones, those can be set automatically by a 


computer or they can be set manually, right? 


A. I would agree. 


Q. Okay. And, for example, I could set my computer here in 


_ 


Miami to Australia time 1 I wanted to? 


A. You could. 


Q. And then the documents created on my computer would ret! 


Australia time, right? 


A. They would most likely, yes. 


Q. Most likely. I notice that you said that a few times in 


your direct testimony, sir. By "most likely," it means that 


based on your education and experience you believe that's the 


most likely result? 


A. Correct. 


Q. Sir, I think you said: "Most likely" at least a few times. 
Does that mean you don't know for sure? 
think it depends on the specific circumstances. 


Fi og 


t's take that one for just a second because I want to 


make sure that we're on the same page, and I'll come back to 


that ina little more detail. 


just posed a hypothesis to you, didn't I? 


A. It was a very general question, but yes. 


Q. The hypothesis was, if I set my computer to Australia time, 
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then my computer would reflect Australia time. That's the 


hypothesis, right? 


A. 


Q. Can we make a prediction from that? Going back to the 


scientific method, if I set my computer to Australia time, then 


wouldn't u predict that if you looked at the metadata you 


woul that the documents produced would reflect -- what is 


11, is that what it is? 


or +1 


10 depending on Daylight Savings Time. That would be 


your prediction, right? 


A. It would be for the documents we discussed. 


Q. Right. And I think right now you would say to the jury: 


"Most likely," right? 


That's a theory, right? 


suppose it's consistent with my experience with these 


of documents, though. 


understand, sir. It's also consistent with -- would you 


_ 


agree with me that for thousands of years it was consistent 


with human experience that the earth was flat? 
A. I suppose. 


Q. Right. And that was a theory. You know that that was a 


theory at one time in the world, was that the earth was flat, 


because if you looked at the horizon it looked flat. You know 
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that, don't you? 


MR. ROCHE: Objection. Relevance. 


THE COURT: Overruled. T'll allow that. 


THE WITNESS: Sure. 


BY MR. FREEDMAN: 


Q. And later, after we started circumnavigating the planet, we 


learned as human beings we learned that the planet was not 


flat. You know that history. That's not hidden, right? 


A. sure. 

Q. Sir, when you say it's most likely that my computer 
metadata would reflect Australia, that's based on your 
experience, that's based on your expectations, your theory, but 


to test it, wouldn't we need to change my computer to Australia 


time, then create a document, and then look at the metadata to 


see if it shows Australia time, UTC+11, or if it shows British 


yg 


time or if it shows American time? Wouldn't we need to do that 


just to start to experiment on that question? 


A. I suppose. But certainly it's been my experience that 


creating, say, a PDF and then analyzing the metadata, it 


reflects the time zone of my computer. 


Q. That's your experience, sir. I'm talking about the 


nd 


scientific method. Wouldn't you need to test it to be able to 


I tested my hypothesis"? 


suppose you could, but I have no reason to believe that 


lO is treated any differently than UTC-4 or 5. 
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MR. RIVERO: I'm sorry. I had a little bit of trouble 


hearing you. Can I ask the court reporter to read that back? 
(Read back.) 

BY MR. RIVERO: 

Q. Right, sir. I understand. My question is not about 


whether UTC 11 is different from UTC 4. My question is: You 


_ 


cannot in the scientific method test your theory unless you do 


an experiment; isn't that true? 


A. I suppose, but the results of my analysis of this document 


is still consistent with my experience with analyzing the 
metadata of similar documents. 


Q. Sir, you're jumping way ahead in my examination. But are 


you saying by that answer that you didn't test any of these 
hypotheses you came up with here? Is that what you're saying? 


A. If your question is did I create a PDF in time zone UTC+10, 


no, I did not. 
Q. And, sir, that wasn't my question anyway, but we're going 
to get there. 

My question was simply: To start to prove or disprove that 
the changing of the clock on my computer would result ina 


certain result in metadata, you would need to do it on my 


computer and see if that happens, wouldn't you, under the 
scientific method? 


A. I suppose. 


Q. All right. You agree with me that there are things that 
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can change the dates found in the metadata besides the system 


clock or manual manipulation by a person? 


I'm not sure. I think I would need an example. 


I'm sorry. I t hear you. 


I'm sorry. I t entirely sure. I think I would need an 
example. 

Q. So you don't know? 

A. Off the top of my head, I don't know what scenario that 


would occur. 


Q. All right, sir. Now, you do say that one of the reasons 


that you're associating Dr. Wright with this is because certain 


IP addresses are associated with Eastern Australia? 
A. Yes. 
Q. Okay. But you did nothing, again, to go back to the 


associated IP addresses to determine whose they were? 


A. Correct. Aside from the GeoIP lookup. 


Q. Right. And we will get back to the second flaw. 


Another reason you believe the manipulations were 


consistent with Dr. Wright is because of the computer names in 


the metadata, right? 


A. Yes. 


Q. Okay. But you would agree with me, sir, that computer 
names are metadata and they can be manipulated, right? 


A. I would agree. 


Q. Okay. And in fact, even if the emails were sent 
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devices associated with Dr. Wright, even if that were the case, 


you would agree with me that doesn't mean that Dr. Wright sent 


them? 


A. I would agree. 


Q. And you would agree it's certainly possible that someone 


could have gained access to either Dr. Wright's account or his 


device; isn't that true? 


A. I would agree. 


Q. Now, isn't it true that Plaintiffs produced a document that 


is an email exchange that reflects David Kleiman sending 
himself an email on June 30th, 2018? 


A. T'm not familiar with this document. 


Q. Let me ask you -—- 
MR. RIVERO: Let me show just the counsel and the 


witness D58. 


Your Honor, I'd move the admission of this document as 


an admission of a party opponent. D58. 


MR. ROCHE: Your Honor, we object on the basis that 


this expert, Dr. Edman, doesn't have the proper foundation to 


examine this document. 


MCGOVERN: I believe it's already in. 


RIVERO: I'm sorry. I'm corrected. I'm told it's 


know if that's right, Judge. 
COURT: D58 is in evidence. You may use it. 


RIVERO: All right. Let's show the jury Db58. 
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BY MR. RIVERO: 
Q. All right. Now, the jury has it. So I don't k that 


this has been spoken about with precision, Dr. Edman. So I'm 


going to ask you: Are you familiar with the fact that the 


documents produced between the parties in the case have a 


little number -- and sometimes we lawyers forget, you know, 


that it could be that -- we make assumptions. Do you see that 


little number that Mr. Shah has blown up that says: "Kleiman" 


and then has a bunch of numbers after it? 
A. elon 


Q. You do litigation-related work, so I assume you know that 


that's what's called a Bates stamp, right? 


A. Yes. 


Q. And a Bates stamp is nothing more than an identifier of 


_ 


with a name before it followed by a number that a party in 


litigation will put on a stamp so everyone knows where it came 


from, right? 


A. Yes. 


Q. Okay. So do you understand this document was produced by 


the Plaintiffs' side? 


A. I haven't seen this document, but I believe that based on 


the Bates stamp. 


Q. You haven't seen this document because Plaintiffs' counsel 


didn't ask you to look at this document, did they? 


A. No, not to my recollection. 
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Q. All right. So let's look at the document. 


MR. RIVERO: Mr. Shah, if you would put this back. 


BY MR. RIVERO: 


Q. So, sir, you see this is a document that says from Dave 
Kleiman to Dave Kleiman and is dated Saturday, June 30, 2018, 
right? 

A. 

Q. All right. I think you said many, many times that David 
Kleiman was dead by April 26th, 2018. Do you recall that? 


A. I think he was dead before April 26th, 2018. 


Q. Correct. I said: "By," but we don't know the exact date. 


Sir, David Kleiman could not have sent himself this 


document on June 30th, 2018, correct? 
A. Correct. I believe so. 
Q. Okay. So would you agree that we don't know how this came 


about? We have no idea who did this, right? 


A. I haven't analyzed this document, so no, I don't know. 


Q. Okay. Sir, I think you would agree with me that a lot of 


these manipulations that we saw were not very sophisticated, 


right? 


A. Ina sense, yeah, I would agree that there are some obvious 


mistakes with manipulations. 


Q. I think Plaintiffs' counsel even took you to one where you 


said it was less obvious. Do you remember that? 
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QO. Yes. It was the one that you said that, I think -- I'm not 


sure what you meant, sir, but I am going to -- it was 


Plaintitrs" 338. 


Do you remember that? 


A. I believe I know which document you're talking about. 


Q. Yes. What you testified to the jury on examination by 


Plaintiffs' counsel was that one wasn't so obvious, right? 


A. Right. 
Q. Okay. Sir, would you agree with me -- I think you would 


agree with me -- that clocks being rolled back, that's not some 


really sophisticated method for altering a document, is it? 


A. I would agree that's not sophisticated. 


Q. And human-readable text being changed with a touch-up 


editor -- by the way, I don't want to -- I mean, I don't know 


these things, but when you talk about TouchUp Text editing, 


that's a way that you change what's in the document that you 


can read, right? 


Okay. So changing what a document says by retyping a word 


or, you know, cutting it out and then putting another word, 


that's not very sophisticated, is it? 

A. No. 

Q. All right. Any of us, essentially anybody who knows how to 
use a word processor, would be able to do that, right? 


A. With the appropriate software, yes. 
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Q. 


extremely pro 


Okay. So wouldn't you agree with me that someone who's 


_ 


icient in computers and the use of computers 


could make metadata changes without detection or close -- let 


me 


restate that. 


Wouldn't you agree with me that a person who's extremely 


proficient in computers could make metadata modifications that 


would be very difficult to detect? 


A. 


Q. 


I suppose that's possible, yes. 


Now, Sir, you were able to easily discover these purported 


document manipulations, right? 


A. 


There was some analysis involved, so I wouldn't say it was 


necessarily easy, but certainly some of the manipulations were 


Q. 


bu 


t you didn't have a lot of dif 


fairly obvious. 


We'll get back to how you got to select these documents, 


— 


iculty finding a difference 


tween a metadata date and the date on the exhibit, did you? 


You would agree, I assume, that Dr. Wright is an extremely 


ficient user of computers? 
MR. ROCHE: Objection. Relevance. Outside the scope. 
THE COURT: Sustained. 


MR. RIVERO: Your Honor, may I have one moment, Judge? 


THE COURT: Certainly. 
(Pause in proceedings.) 


MR. RIVERO: Your Honor, I would ask to be heard at 
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sidebar on this. 
THE COURT: You may continue. 
BY MR. RIVERO: 


Q. Are you aware that Dr. Wright has over 45 computer 


— 


certifications related to computer forensics? 


MR. ROCHE: Objection. Relevance. Outside the scope. 
THE COURT: Sustained. 
BY MR. RIVERO: 


Q. Sir, you did not take into account -- in making your 


determinations or giving your opinion about consistency of 


manipulations with Dr. Wright, you did not take into account 


Dr. Wright's skill/abilities when you determined that? 


MR. ROCHE: Objection. Relevance. Outside the scope. 


THE COURT: Overruled. I'll allow it. 


THE WITNESS: I have no knowledge of what skills 


Dr. Wright may or may not have regarding these documents. 


BY MR. RIVERO: 


Q. So I'm going to ask my question again, sir, and ask you to 


answer that question. 


You did not take into account anything to do with 


Dr. Wright's computer skills in reaching the conclusion that 


these changes were consistent with Dr. Wright having done it? 


_ 


A. Again, I have no knowledge of what his skills with respect 


to manipulating documents may be, so no, I did not take that 


into account. 
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Q. Let's go back to the MaxMind. The second flaw, sir. 


You remember that you did tell me that certainly as of the 


time you gave any report or prior testimony in this case you 


had looked at a version of the GeoIP -- I think it's also 


called MaxMind -- that did not give you historical information, 
correct? 


A. Correct. 


Q. But separately, sir, MaxMind has another signit 


does it not? 


A. I'm not sure what you're referring to. 


Q. Let's make sure we understand how MaxMind works. IP 
addresses are assigned by Internet providers, right? 
A. Yes. 

That's what IP means is Internet provider? 

No. 


I'm sorry. Intellectual property. 


So what is an Internet provider? 


An Internet service provider? 


Yes. 

We'll say the company that provides you access to the 
Internet. 
Q. Can you give us an example? 


A. Verizon. 


Q. Okay. And so the ISP, the Internet service provider, would 


assign the IP address; is that right? 
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A. Yes. 


Q. Okay. Then does that Internet service provider report the 
IP address to MaxMind? Is that how that works? 
A. Not necessarily. 


Q. How does MaxMind get it? 


A. Exactly how they collect their information I believe is 
proprietary. There are a number of public sources, such as 


WhoIs information that I understand that they collect. 


Q. Okay. 
A. But I don't believe that MaxMind provides an exhaustive 


A oe 


list of exactly where they source all of their information. 


Q. Okay. So you don't know. 


You don't know, sir -- as you sit here today, you don't 


know who Dr. Wright's Internet service providers were in 2014; 
is that right? 
A. I believe that's correct, yes. 


Q. And you don't know who his Internet service providers were 


in 2015? 


A. Correct. 


And you don't know that information for 2013? 


Correct. 


Q. You will agree with me that MaxMind contains millions of 


erroneous data items in its database, will you not? 


A. Perhaps. I guess it depends on what you mean by erroneous. 


Q. Well, doesn't MaxMind itself claim that it is not 100 
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percent accurat 


A. I agree wi that, yes. 


Q. And isn't it the case that if you take its percentage of 


error, in other words, the percentage that it admits it's of 


from 100 percent, that there are millions of erroneous data 


items in its database? Isn't that true? 


A. I don't know the exact number, but you are correct that it 
is less than 100 percent accurate. However, my experience, I 
have found it to be reliable. 

Q. Sir, isn't that at least eight million erroneous data 
entries? 


A. Perhaps, but there are significantly more than eight 


million IP addresses. 


Q. I understand, sir. 


Sir, you don't know any reason why any IP address in this 


case would not be among the erroneous data items on MaxMind, do 
you? 
A. I suppose it could. I have no reason to believe it, but 


is possible. 


Q. You have no reason to know that they're not? 


+ 


A. Sure. Except for the results from it do appear to be 


consistent with other evidence in this case. 


Q. Sir, so let's talk about that. Do you know where Wooloowin 
is? You remember you saw Wooloowin, and I think that was -- 


let me see if I can get that number again. 
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Do you know where Wooloowin is? 
A. I understand it's in Queensland, but where exactly it is, I 


don't know. 


Q. Yes. Are you aware Wooloowin is in a city named Brisbane, 
Australia? 
A. I wasn't before. 

You're not right now? 

I'm taking your word on it. 

Okay. So you don't know? 

I don't. 


All right. You didn't check it? 


I did not. 
Do you know, sir, whether or not Brisbane, Australia, is 
more than a thousand kilometers away from Sydney, Australia? 


A. I do not. 


Q. Do you know whether Wooloowin is a suburb of Brisbane? 


A. I do not. 


Q. Do you know whether Jamie Wilson lived in the suburb named 


Wooloowin? 


I do not. 


And you don't know whether Dr. Wright lived in Sydney? 
I do not. 


You didn't check any of this? 


No. Again, I was only relying on sort of the general 


region, not necessarily the city. 
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Q. Well, sir, let me show you 856.2. 


MR. RIVERO: Mr. Shah, if you would bring that up f 


the jury. It's in evidence, submitted by the Plaintiffs. 


No. No, sir. 856.2. 

Can you pull out Wooloowin, Queensland, Australia. 
BY MR. RIVERO: 
Q. Can you see that, sir? 
A. I can. 


Q. Sir, when you got the document -- and I understand that you 


looked at all of these data items, metadata, the date created, 


the date modified. You showed us all that. There was a lot of 


red circles and highlighting and pullouts. Right? 


spent some time looking at these pieces of paper -- 


That's old school -- at these digital documents, right? 


you notice that there was a location called Wooloowin? 


Only in this particular exhibit. 


Q. I understand, sir, but what I'm saying is: One of the 


things you say is consistent with Dr. Wright is that it was 


Eastern Australia, right? 
A. 
Q. Your reports over and over and over again talk about the 


geographic location being consistent with Dr. Wright, correct? 


A. Yes. 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document:53-12 Date Filed: 11/30/2022 Page: 192 of p6A 


Q. And, sir, by the way, just to be clear, do you understand 


there's 19.4 million people living in Eastern Australia? You 


know that? 


A. I did not. 


Q. Okay. Sir, this is not like some desert or something, 
right? 

A. Some parts may be, but —- 

Q. Sir, here's the point: Did it ever occur to you in doing 
your expert work to say: "I am saying as an expert that this 


is consistent with Dr. Wright because it's Eastern Australia," 


to look and see where that town is and determine whether that 


town is close to where Dr. Wright lived? Did that occur to 


you? 


A. I believe I looked up where this was at one point. But 


again, I'm not really relying on the specific city. Again, I'm 


just looking at the general region. 


Q. Did you try to determine whether any other witness, like 


Jamie Wilson, lived in this town? 


A. No, not to my recollection. I don't believe I had any 
reason to. 
Q. Okay. Now -—- 


MR. RIVERO: Pardon me, Your Honor. I've 


THE COURT: All right. 


MR. RIVERO: I'll just be one moment. 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 193 of fA 


(Pause in proceedings.) 
BY MR. RIVERO: 


Q. Now, can you tell us what a VPN is, sir? 


A. A VPN, or virtual private network, is a software protocol 


that you can use to route all of your traffic through another 


computer on the Internet. 


Q. So does that allow somebody who has a VPN -—- could they be 


sitting in one country but it could appear that they were 


actually in another country? 


A. It's possible, yes. 


Q. Well, for example, I don't know how this works, sir, but if 


a VPN were used, would the metadata pick up the place where the 


computer's located or would it pick up where the VPN is 


projected to, or do you know? 


A. It would depend on the specific metadata you're talking 


about. 


You would need to look at the metadata, right? 


t, sir, when you say it would depend on the specific 


metadata, as you sit here right now I assume you're not able to 


tell us the precise effects of the use of a VPN projecting from 


one country to another on every kind of metadata, are you? 


On every possible kind of metadata? 


Yes, sir. 


No. I mean, I think we would need to talk about specit 
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Q. Okay. Perhaps we would need to test what happens if a VPN 


projected from one country to another to see the effects on the 


metadata to test what it actually does. Is that possible to 


do? 


A. I mean, again, I think we would need to look at specifi 


metadata. 


Q. Let me ask you a question. I have a question. f we 
took -- if we did a test and we set up a computer here today 


and we used a VPN, whatever it is, sir -- and I'm just using 


initials that I don't really understand, but you apparently do. 


If used a VPN and it somehow, however these things work, 


projected the computer into another country, could we print the 


metadata to see if it reflected the geographic location here 


versus in Mexico or wherever it was projected? Could we do 
something to see what it does? 
A. You could. 


Q. Okay. Do you know whether people use VPNs -- what did you 


call it? A virtual? 


A. Virtual private network. 

Q. -- to watch television in a country where certain channels 
are restricted? 

A. They do. 

Q. So like when I've been in these situations that I want to 


open my Netflix but I'm in some other country and I can't get 


Netflix, if I had a VPN, I might be able to get into the 
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flix? 


A. Possibly. 
Q. All right. And you would agree that somebody could have 


used -- somebody outside of Australia could have used a VPN to 


make it look like they were in Australia; isn't that possible? 


A. It is possible. 


Q. Now, the computer time zones are set by the computer user; 
is that right? 

A. Typically. 

Q. And anyone can set their computer clock to a time zone 
associated with Eastern Australia? 


A. Typically. 


s! 


Q. Now, you opined that the PGP version f Plainti 


Exhibit 546 -- and I noticed something. I me change subjects 


just for a moment, sir. 


Every single one of these forgeries that you opined about, 


every single one I noticed has a Plaintiffs' exhibit number; 


isn't that right? 


A. I believe so, yes. 


Q. We didn't see -- out of the 10 that you showed, we didn't 


see a single one that had a Defendant's exhibit number, did we? 


A. Not that I recall. 


Q. So you understand, sir -- you're familiar with 


litigation -- that the Plaintiffs marked all those exhibits? 


MR. ROCHE: Objection. Relevance. 
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THE COURT: Sustained. 


BY MR. RIVERO: 


Q. So you opined that the PGP in 546 -- and I want to see if 


this is one of your examples. Sir, I don't think you used it 


today, but in your report, you opine about Plaintiffs' Exhibit 
546. Do you remember that? 
A. You'll have to refresh my memory. 


MR. RIVERO: All right. Why don't we show the witness 


and counsel Plaintiffs' 546. It's in evidence, so I'd ask for 


publication to the jury. 
THE COURT: Yes. 


MR. RIVERO: Thank you. 


BY MR. RIVERO: 
Q. All right, sir. Now 546 -- I'm pretty sure you weren't 


shown it this morning, but you have in your report said that 


you believe 546 is inauthentic, right? 


A. Correct. 
Q. Okay. Do you —- sir, I'm not seeing it in my notes, but is 
this one of the 10 examples? 
A. I believe this is forgery number two. 
Q. 546 is altered document number two. 

Okay. Sir, you said that the document was really created 
on March 4, 2014, if I remember correctly, or you said also it 


could have been February 28th, 2014, right? 


A. Yes. I believe this -- you're showing me just one page of 
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this document which had multiple pages and multiple signatures. 
One of them I believe was February 28th, and the other, I 


believe you are correct, was March 4th, 2014. 


Q. Okay. So now, have you seen, sir -- I don't know if you 


opined about Plaintiffs' 450. Not today, but at another time. 


MR. RIVERO: T'll ask if that's in evidence. 


If you can show the witness and counsel Plaintif 


450. 
BY MR. RIVERO: 
Q. Sir, are you -- 
MR. RIVERO: Your Honor, may I have one moment? 
THE COURT: Certainly. 
(Pause in proceedings.) 
MR. RIVERO: All right. Let's put that aside. 
BY MR. RIVERO: 
Q. Now, one of your areas of expertise is responding to 
computer hacks; isn't that true? 


A. Yes. 


So you are familiar with what computer hackers are? 


Yes. 
And you yourself possess many hacking tools? 
I suppose. 


Well, you possess tools that are designed to be used to 


_ 


compromise the security of computer systems, do you not? 


MR. ROCHE: Objection. Relevance. 
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THE COURT: Overruled. T'll allow it. 


THE WITNESS: I suppose, yes. 


BY MR. RIVERO: 


You are familiar with how to detect a computer hack? 
Yes << 


You have given expert testimony about this subject? 


Not that I recall specifically regarding any sort of 
think if you're referring to hacking tools, I have, yes. 
Q. Okay. You're aware that Dr. Wright -- you were here during 


mag 


his testimony -- that he has testified that he and his company 


computers were hacked. You heard that? 


A. I heard the claim, yes. 


Q. You never looked at any of Dr. Wright's accounts to see if 
there was any evidence of hacking, did you? 


A. I wasn't retained in this matter to determine whether or 


not at any point Dr. Wright or any of his companies had been 


hacked. I think that's a very different line of inquiry. 


_ 


don't believe I had access to the information that would all 


me to conduct that sort of investigation. 


Q. And also you didn't look at any of his devices to determine 
whether he had been hacked? 

A. I didn't have access to any of these devices. I understand 
your experts did. 

Q. Did you ask, sir, for -- are you saying that you were 


denied access to those? Let me back up. 
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Did you ask to look at those devices? 
A. I believe we had discussions related to that, yes. 
Q. And so did you make such a request? Did you request: "I 
want to look at those devices to determine hacks"? 
A. I don't recall the exact language, but I know we did 


discuss it. 


Q. Isn't it true that you have conceded that your access to a 


certain communications channel by Dr. Wright could constitute a 


form of hacking? 


MR. ROCHE: Objection. Relevance. 


MR. RIVERO: Judge, if I may. I'll tie it. 

THE COURT: Yes. The objection is sustained. You may 
rephrase. 
BY MR. RIVERO: 
Q. Are you aware that Dr. Wright has communications on a 


channel called Slack? 


MR. ROCHE: Objection. Relevance. Outside the scope. 


THE COURT: Sustained. 


MR. RIVERO: Your Honor, I would request to go sidebar 


THE COURT: Come on forward. 
(At sidebar on the record.) 
MR. RIVERO: Judge, this evidence has been used by the 
Plaintiff from the Slack channel. 


COURT REPORTER: I can't hear you. 
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MR. RIVERO: Oh, can you hear me now? 


This evidence has been used by the Plaintif from the 


Slack channel. And in fact, this gentleman has testified that 
he did do a form of hacking on the Slack channel. The 
question -- 


THE COURT: And when did he testify that he dida { 


f hacking in this case? 

MR. RIVERO: In his deposition, Judge. 
THE COURT: In this case? 

MR. RIVERO: Yes. 

COURT: Is that correct? 


ROCHE: That he hacked it, no. 


THE COURT: That he did a form of looking at hacking 
on a Slack channel? 

MR. RIVERO: Your Honor. 

ROCHE: No. 

RIV] : Yes, Your Honor. 


ROCHE: Let's see the deposition testimony. 


Your Honor --— 


Was he retained for that? 


No. 


Then what's the issue? 


RIVERO: No. No, Judge. Wait a minute. These 


gentlemen are misrepresenting the record. 


He was asked if he had gotten access to a private 
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Slack channel belonging to Dr. Wright. He was asked about 


those credentials. He said he was given those credentials 


by -- and I'm not going to go into this part with him -—- he was 


given those credentials by Plaintiffs' counsel. He said he 
didn't believe he was authorized to use those credentials. He 


called it a form of hacking. And I think I'm entitled to 


establish about this hacking question that both he's hacked 
Dr. Wright, which is what his own testimony says -- 
THE COURT: Who's hacked Dr. Wright? 


MR. RIVERO: This gentleman. He had said it in his 


deposition testimony, Your Honor. 


HE COURT: You're going to have to give me a page and 


line. That he hacked Dr. Wright's computers? 


MR. RIVERO: He testified that -- he admitted it was a 


form of hacking in his deposition testimony. 


THE COURT: No, but did he testify that he 


MR. RIVERO: Yes. 
HE COURT: -- directly hacked -- 


RIVERO: Yes, Judge. 


MR. ROCHE: Your Honor, I think this would 


more productive if we had the testimony in front of 


MR. RIVERO: Can I, please? 


THE COURT: Yes. Let me see. Let me see. What's the 


page and line? Let me see it. 


Is this it? 
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"T'll ask you the question. The record says what it 
says, but if you are not authorized" -- 

MR. RIVERO: "You are not authorized to use, access 
that workspace." 

THE COURT: Where is the testimony? This is 
question. 
RIVERO: Hold on. "Witness" —- 
COURT: "It could be"? 


RIVERO: "It depends," Your Honor —- 


TI COURT: No. No. We're so far afield. 


li objection is sustained. 
(End of discussion at sidebar.) 
BY MR. RIVERO: 
Q. You have opined that approximately 40 documents have been 


manipulated. That's your opinion in this case? 


A. To the best of my recollection, that's the approximate 
number. 


Q. Are you aware, sir, that between the two sides there were 


hundreds of thousands of documents produced in the case? Do 
you know that? 


A. I do. 


Q. You didn't attempt, and it wouldn't be feasible, to review 


all hundreds of thousands of documents to determine whether 


with -- how many of them had manipulations, right? 


A. I did not, and I agree that it would not have been feasible 
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to do so. 


Q. You didn't attempt to review all the documents there 


were something -- just about a thousand documents that were 


marked between the two sides as exhibits. Do you know that? 
A. I don't. 


Q. All right. But you'll agree with me you didn't attempt to 


review the thousand or so documents marked by both sides to 
determine manipulations? 


MR. ROCHE: Objection. Relevance. His expert report 


was submitted before the exhibit list. 


THE COURT: No. No. It's proper. Overruled. 


THE WITNESS: I did not. 


BY MR. RIVERO: 


Q. Sir, your fourth expert report was submitted aft 


October Ist of this year, was it not? 


A. No, I don't believe that's correct. 
Q. Sir, are you saying you didn't submit a supplemental expert 


report naming three additional documents less than a month 


before this trial? 


A. To the best of my recollection, I submitted the report 


you're referring to on September 17th. 


Q. I see, sir. So it was six weeks instead of less than 30 
days, right? 
A. Yes. 


Q. Okay. So, sir, when you submitted that report, the exhibit 
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_ 


list in this case had been in for a long time, hadn't it? 


A. I don't know exactly when the exhibit list was put in. 


think there were a number of updates that were made to it, but 


I can't speak to exactly when those changes were made. 


Q. Regardless, you didn't try to review a thousand-plus 


documents to determine manipulations, right? 

A. I did not. 

Q. What you did was, if I understand correctly -- what I 
understand that you did is that you took only the documents 


produced from Dr. Wright's side and you only looked at 


documents produced by Dr. Wright in this case. Isn't that 


true? 


A. I looked at the documents that the Plaintiffs, who hired 
me, asked me to look at. 


Q. I am getting there, sir. But before we get there, isn't it 


true that every document you looked at was a document produced 


from Dr. Wright? 


A. No. I believe forgery number one was contained within a 


document produced by Ira Kleiman. 


Q. So you're saying that one document, because it was a 


forward from Craig Wright to Ira Kleiman, that's the single 


document that you looked at from the Plaintiffs' side in your 


_ 


recollection o 


things? 


A. To the best of my recollection, yes. 


Q. Every other single document you looked at was only | 
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Dr. Wright's side; isn't that right? 


A. To the best of my recollection, yes. 


Q. Okay. Now I may -- sir, please correct me, because I'm not 


sure that I understand what you have said about this. But you 


oY sg 


ran —-- if I understand, you ran all of Dr. Wright's produced 


documents and out of that you identified a subset that had some 


Ss ' 


characteristic that you then turned over to Plainti 


counsel. Is that how this process started? 


MR. ROCHE: Objection. 
COURT: The basis for the objection? 
ROCHE: Privilege. 


COURT: Sustained. 


BY MR. RIVERO: 


Q. All right, sir. Isn't it true you identified ten thousand 


documents that had artifacts that you thought could be 
questionable? 
A. I don't recall that specifically. 


Was it thousands? 


I don't recall. 

Was it a large number? 

Probably. 

And sir, at the end of the day, you were asked to look at 


the —-— whatever the number -- you were asked to look at 40 or 


50 or whatever number of documents by Plaintiffs' counsel; 


isn't that right? 
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A. Yes. 


Q. And, sir, as to each document that Plaintiffs' counsel 


picked, you found that every single one was manipulated? 
A. It appears so, yes. 


Q. That's not my question. By saying: "It appeared so," does 


that mean there's doubt about your conclusion? I'm not sure I 
understand that answer. 


A. In my opinion those documents were manipulated. 


Q. Okay. So if you say: "It appeared so" -- if by that you 
mean you don't know, please tell us. 


A. OkKay. 


Q. All right. They gave you 40 documents. You { 


manipulated documents. Isn't that right? 


I believe that's the approximate number. 


it was 45, whatever it was, whatever documents they 


_ 


asked you to look at for manipulation, you said that's 


manipulated? 


A. I believe that the documents that they asked me to look at 


they had reason to believe were manipulated, and so they were 


asking for an independent opinion. 


Q. Sir, hadn't you handed them a much bigger set of documents 


and then they cherrypicked out of that much bigger set of 


documents a subset? 


MR. ROCHE: Objection. Improper question. Calls 


speculation. 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 207 of 264 


THE COURT: If the witness knows. 


THE WITNESS: I don't know specifically why they 


picked certain documents. You would have to ask them. 


BY MR. RIVERO: 


Q. Yes. I understand that. But I'm asking you a dif 
question. 
Didn't you give them a much bigger universe and then they 
handed you back a much smaller set? 
MR. ROCHE: Objection. Asked and answered. I believe 


it was already -- 


THE COURT: Overruled. T'll allow it. 


THE WITNESS: Yes. 


BY MR. RIVERO: 


Q. You reviewed the documents that Plaintiffs' counsel told 


you to review? 


Yes. 


And, sir, you're an expert witness. I mean, you work f 
Plaintiffs' side, right? 


I do. 


I'm not suggesting that -- you were just following the 


instructions you've been given, right? 


A. In a sense. Obviously I'm providing an independent 


opinion, but I believe I need to stay within the scope of 
work. 


Q. It was certainly indicated to you that the reason you 
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reviewing these documents was suspicions? 


MR. ROCHE: Objection. Privilege, asking for the 


reason for reviewing the documents. 


THE COURT: Sustained. 
BY MR. RIVERO: 


Q. Later -- whatever that initial number was, later they asked 


you to look ata let me 


MR. RIVERO: Judge, I'm going to move on from that 
question, I think. 


HE COURT: All right. 


BY MR. RIVERO: 


Q. Later, after -- at a later time, like September 17th, you 


_ 


fied some additional documents, right, as manipulated? 


Three? 


I believe so. 


In that case, did you pick them to look at or did 


Plaintiffs' counsel pick them to look at? 


MR. ROCHE: Objection. Privileged. 


HE COURT: Sustained. 


BY MR. RIVERO: 


Q. In reviewing these documents, sir, you didn't use what's 


called a clean test environment, did you? 


t initially, but as I testified I believe in my second 


tion, I re-reviewed the documents. I didn't believe it 
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made any difference, and I confirmed that it made no 


difference. 


Q. You didn't use a write blocker? 


A. No. 


Q. And the reason you felt you didn't need to use any of those 
in the initial run was because you already had an idea what the 
result you were going to find was? 


A. No, not necessarily. 


Q. Sir, you had -- before you looked at the documents, before 


you actually did whatever you did, you had an idea of what the 
nature of the manipulations might be as to these documents, 


didn't you? 


A. Certainly the manipulations were consistent. So as I wrote 


a review on an additional document, I kind of had a framework 


of indicators that I would look for. 


Q. Sir, when you went in to start your analysis, you already 


had an idea of what you were going to find on those documents 


because you had an idea of what the nature of the manipulations 
was? 
A. Yes. 


Q. Sir, when you initially did your work at the beginning, you 


didn't save a copy of the hash values that you generated for 
these documents? 
A. I did not. 


Q. And, sir, this is going to take some explanation because I 
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certainly couldn't do it, but a hash value is some sort of 


_ 


unique identifier that you can attach to a digital docume 


Am I in the ballpark? 


A. It's sort of like a fingerprint. 


Q. Okay. But you applied the like if you're using the 


document, you can apply a fingerprint to it. Is that how it 


works? 


=e 


A. You can compute the fingerprint. 


£_ 


Q. You could compute a fingerprint. But in any event, 


whatever it is that you do to get there, you could -- like if 


you're starting to work with a document, you could get this 


hash value, which is like a fingerprint, and then you know 
exactly how it looked when you started with it, right? 

A. 

Q. You didn't do that when you first studied these documents, 
right? 


A. I believe I did. 


You didn't save them on the first go-round? 
A. Correct. 
Q. Okay. Got it. You did it, but then you didn't save it. 
That's the only point I was asking. 
A. Correct. 


Q. Yes. All right. 


MR. RIVERO: If you would show Plaintif 


I believe it's in evidence, Your Honor. 
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THE COURT: It is in evidence. 


MR. RIVERO: Thank you. So if I may show the jury. 


BY MR. RIVERO: 


Q. Plaintiffs' 630 I believe has already been shown to the 


jury. This is the document that you referred to which was the 
Single document that was from the Kleiman side that you were 
asked to look at, right? 


A. 


Q. And we know it's from the Kleiman side because 
MR. RIVERO: If you would, Mr. Shah, pull up that 
Bates name. 


BY MR. RIVERO: 


Q. Okay. But, sir, the reason -- okay. The significance 
this document is what you find is inauthentic -- 

MR. RIVERO: Mr. Shah, if you could just put the 
document back up. 
BY MR. RIVERO: 


Q. -- is the email underneath, the Craig Wright to Craig 


Wright. That's what you say is inauthentic, right? 


A. Yes. 

Q. You don't say that the Craig Wright to Ira Kleiman is 
inauthentic? 

A. I don't believe it is. 


Q. So every single document that you determined the 


authenticity of had to do with what Dr. Wright did; isn't that 
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right? 


A. With documents he produced. 


Q. Okay. The reason that you didn't look at any Kleiman 


documents is the Plaintiffs' lawyers didn't ask you to look at 
the Kleiman documents? 

MR. ROCHE: Objection. Objection. Privileged. He's 
asking for the reason. 


THE COURT: Sustained. 


BY MR. RIVERO: 


Q. In any event, you didn't look at a single Kleiman document? 


A. I'm looking at one right now. 

Q. Well, sir, again, with the conditions that we just 
described, right? 

A. Correct. 


Q. You're not able to tell the jury whether there are any 


other documents in this case other than the ones that you have 
reported on, the 40 -—- you can't tell them one way or another 
whether any other document in the case has the same 
characteristics of manipulation that you say these documents 


have, can you? 


A. No. I did not review every document produced in this case. 


Q. Right. But other than the 40 or 50, whatever the number 
is, you can't say as to any other document in this case whether 
it's manipulated because you didn't look? 


A. Correct. 
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Q. Now, sir, I'd like to show you -- 


MR. RIVERO: Judge, if I may have one moment. 


(Pause in proceedings.) 


MR. RIVERO: I'd like Mr. Shah to show you, and this 


is evidence in the case, Plaintiffs' 2. If you could, Mr. 
Shah. 


BY MR. RIVERO: 


Q. Now, sir, first, do you see this is a document that is 


marked —-— 

MR. RIVERO: If you can blow up the bottom, Mr. Shah. 
It's marked Plaintiffs' 2 at the bottom. 
BY MR. RIVERO: 


Do you see that, sir? 


You understand that's a document marked by the Plaintif 


Yes. 


Now let me ask you about this Bates number. This 


D-E-F-A-U-S with a number after it, you saw some of those, 
right? 

A. I did. 

Q. Did you come to learn that those were documents produced by 
Dr. Wright's counsel in Australia? 

A. I don't know exactly who produced them, but I did come to 


learn that they came from Australia somehow. 


Q. All right. Do you understand there were different sources 


Yvette Hernandez, Official Court Reporter 
400 North Miami Avenue, 10-2 
Miami, Florida 33128 
(305) 523-5698 


USCA11 Case: 22-11150 Document: 53-12 Date Filed: 11/30/2022 Page: 214 of @64 


for documents that were produced on behalf o . Wright? 


MR. ROCHE: Objection. Foundation. 


HE COURT: Sustained. 


RIVERO: 


ll right. Let's look at the —-- let's look at the document 


ong 


itsel Sir, this document, did you have an opportunity in the 


case to review the Plaintiffs' Second Amended Complaint? 


A. I believe I did at some point. 


MR. RIVERO: Mr. Shah, could you pull up Plaintiffs' 


Second Amended Complaint, and I'm going to have to remember 


where -- this is the -- it might be Paragraph 35 from memory. 


MR. ROCHE: Your Honor, I don't know if this is in 


evidence. It may be. I -- 


MR. RIVERO: Judge, this has been used by both sides. 


COURT: 35°? 
RIVERO: No, judge. I don't know the exhibit 


number. 


COURT: If it's Plaintiffs' 35, it's in evidence. 


RIVERO: No. I'm sorry, Judge. That is a 


reference 1 Paragraph 35. 


COURT: I'm sorry. What's the exhibit number? 
RIVERO: I'm sorry, Judge. 

COURT: Not a problem. 

RIVERO: I was just doing it by memory. 


COURT: Okay. 
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BY MR. RIVERO: 


Q. While they're looking for it, sir, are you aware that this 


document that we were looking at, Plaintiffs' 2, is a document 


referred to in Plaintiffs' Second Amended Complaint? Did you 
know that? 


A. I don't recall specifically. 


Q. Okay. In any event here it is. 
MR. RIVERO: Can I get an exhibit number? 
404, Your Honor, and it's not 35. 
If you could scroll up, Mr. Shah. Keep going to the 


relationship between Craig Wright and -- keep going. 


Keep going. 


Keep going. 


No. I'm sorry. I meant -—-— I'm sorry. f you could 


go, I meant down. I said it the wrong way. 


Okay. Keep going. Yes. Here we are. 

Your Honor, if I may, this has been published to the 
jury numerous times. 

MR. ROCHE: Objection. I don't think this is in 
evidence. 

THE COURT: It is not in evidence. 

MR. RIVERO: Judge, but I believe that both parties 
have published this to the jury. 

THE COURT: You have on occasion. Yes. It's not in 


evidence. 
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Is there an objection to this? 


MR. ROCHE: Objection. Hearsay. Lack of foundation. 


THE COURT: Why don't you ask the question without 


ference to the 


MR. RIVERO: Sure. 


BY MR. RIVERO: 


Q. Well, sir, are you aware that at Paragraph 55 of Second 


Amended Complaint there's a quote from Plaintiffs' 2? 


MR. ROCHE: Objection. Relevance. 


HE COURT: Sustained. 


BY MR. RIVERO 


Q. All right, sir. Let me show you Plaintif 


MR. RIVERO: Thank you, Mr. Shah. 
BY MR. RIVERO: 


Q. Sir, did you analyze Plaintiffs' 2? 


I did not. 


You were not asked to? 


I was not. 


Isn't it true, sir, that there are the same kinds of issues 


with the metadata as to this document that you have reported as 


to other documents? 


MR. ROCHE: Calls for speculation. 
MR. RIVERO: No, Judge. I'm asking -- 
THE COURT: If the witness knows. 


Overruled. 
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THE WITNESS: I can't say without analyzing the 
document. 
BY MR. RIVERO: 
Q. Because you haven't up to now? 
A. I have not. 
Q. All right. 

MR. RIVERO: Could we show the witness 428, the 
witness and counsel. That's Defendant's 428. 


BY MR. RIVERO: 


Q. Sir, I am going to show you metadata for that document. 


Can you identify this as being metadata? 


A. Possibly. I didn't create this document and I didn't 


extract this metadata. 


MR. RIVERO: Let me ask, if we can, Mr. Shah, can you 


put side by side Plaintiffs’ 2 and Defendant's 428. 


BY MR. RIVERO: 
Q. Sir, do you see at Plaintiffs' 2 DEFAUS Bates number 


00081546? 


A. I do. 
Q. And do you see at the top of Defendant's 428 DEFAUS 


00081546? 


A. I do. 


Q. All right, sir. Does this document, Defendant's 428 -- if 


you could show that -- sir, does that have the characteristics 


of metadata? 
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A. It may. Again, I didn't create this document. I didn't 
extract this metadata. 
MR. RIVERO: Your Honor, I would -- 


BY MR. RIVERO: 


Q. Let me ask you, sir, to assume wit for a moment that 


this is the metadata related to Plainti 2. Can you do 


that? 

A. I suppose. Again, I didn't create this document. 
Q. Sir, you're an expert so I'm asking you to make an 
assumption with me. Do you understand? 

A. Sure. 


MR. RIVERO: Your Honor, on that basis I would ask to 


publish D428 for the purpose of this hypothetical. 


MR. ROCHE: Objection. Lack of foundation. 


THE COURT: Sustained. 


BY MR. RIVERO: 


Q. Sir, isn't it the case that the metadata for Plaintif 


this document dated March 12, 2008 -- isn't it the case 


the metadata shows a creation date of July 9, 2015? 


MR. ROCHE: Objection. Lack of foundation. 


THE COURT: If the witness is able to answer. 


THE WITNESS: Again, I didn't create this document. 
didn't extract this metadata. 
BY MR. RIVERO 


Q. If you assume with me, sir, that -- assume with me that 
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I'll be able to establish that the metadata for Plaintif 


shows a creation date of July 9, 2015. Would you agree 


that that is exactly the same kind of artifact that you 


told this jury is the basis for your conclusion that 40 
documents are forgeries? 


MR. ROCHE: Objection. Foundation. Calls 


speculation. 
THE COURT: Sustained. 
BY MR. RIVERO: 
Q. Sir, as -- 
MR. RIVERO: Your Honor, may I pose a hypothetical to 


this expert witness? 


THE COURT: You may. 


BY MR. RIVERO: 


Q. All right. Sir, hypothetically, if the creation da 


Plaintiffs' 2 is July 9, 2015, do you agree with me 


would be an artifact consistent with the kinds of arti 


that caused you conclude that the other documents were 


manipulated? 


A. It could be, but it would depend on what this specifi 


timestamp is referring to. 
MR. RIVERO: Mr. Shah, could you show P2. I thought 
it was in front of the jury. 


Yeah. Just P2. 


Yes, to make sure that the jury is aware of what we're 
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talking about. 
BY MR. RIVERO: 


t's move off that, sir. But you certainly didn't look at 


tadata on P2? 
MR. ROCHE: Objection. Foundation. 
THE COURT: Overruled. 
THE WITNESS: No. 


BY MR. RIVERO: 


On Is that a no? 


A. I did not look at any metadata on P2. 


Q. All right. I believe you've already said that metadata can 
be intentionally modified, right? 

A. Yes. 

Q. And you agree that sometimes metadata can be 
unintentionally modified, right? 


A. 


Q. I mean, isn't it true that sometimes the simple act of 


oa 


saving a document on a different machine or in a different 


place can cause a change to metadata? Isn't that something 
that can happen? 
A. It would depend on the specific metadata you're talking 


about, but I suppose that could happen, yes. 


Q. You would agree that as a result of such changes metadata 


could appear inconsistent with the content? 


A. Again, I think it would depend on the specific metadata 
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you're talking about. 
Q. All right. But there are —-- so that means there are 
circumstances where it could? 


the realm of possibilities, sure. 


Fl oy 


act, there's a document -- 


MR. RIVERO: One moment, Your Honor. 
(Pause in proceedings.) 


BY MR. RIVERO: 


Q. I'd like to show you and counsel D412, sir, and ask you if 


you recall this is an attachment. This is attached to one of 


your expert reports. Do you recall this is attached to one of 


your reports? 
A. Ido. 
Q. All right. Now, sir, isn't it the case -- 
MR. RIVERO: Your Honor, this is an attachment to the 


expert's report. I'd move its admission, 412. 


THE COURT: Any objection? 


MR. ROCHE: No objection. 


THE COURT: Admitted into evidence. 


(Defendant's Exhibit 412 received into evidence.) 


BY MR. RIVERO: 


Q. So I take it that by attaching it to your report you're 


saying it's authentic, right? 
Ae (es Sx 


Q. Okay. But, sir, doesn't this document have inconsistent 
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metadata? 
A. No. 
It doesn't? 


No. 


Sir, for example, it says that the last modified date -- if 


you look at the related dates, it says the last modified date 
is 2010, right? 

A. It does. 

Q. And it says the created date is September 17th, 2010, 
right? 

A. Yes. 


Q. But it says the last printed is -- assuming that this is in 


American form, is July 7th, 2002. 


A. Assuming it's American form, I think that's November 7th, 
2002. 
What did I say? 
July 7th, I believe. 
I'm sorry about that. I don't know. I've lost my mind, 
Edman. 
The last printed says November 7th, 2002, right? 


It does. 


Q. Okay. So you would agree with me that there is something 


wrong because how could the document be printed before it was 


created? 


A. So I believe I testified at my deposition about this, that 
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when you create and modify a Word document and print it, and 


_ 


then if you modify it again and save it as a new document, the 


created and modified are updated but the last printed still 
remains. 


Q. Regardless of how it happened, sir, and I heard the words, 


this shows a date of printing that's eight years before the 


date of creation, right? 


A. Right. 


Q. Okay. And you agree you can't print a document bet 
created, right? 


A. I would agree with that. 


Q. Okay. And if I understand what you're saying is you're not 


worried about that because sometimes when you save a document 


BY ong 


some kinds of metadata may update but other kinds don't update. 
Is that what you're saying? 
A. Specific fields, yes. This is consistent with my analysis 


of Word documents before. 


Q. Okay. I didn't ask about analysis of Word documents. 


Sometimes depending on how you save a document, 
sometimes when you save a document, some metadata updates and 


other metadata doesn't update, right? 


A. It depends on the specific type of document. 
Q. Okay. You agree with me that the way metadata is stored 


can affect the metadata? 


A. I think you would have to be more specifi 
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Q. Well, would you agree that moving data from one server to 


another can affect its metadata? 


A. Depends on the specific metadata you're talking about. 


Q. Some metadata can be affected by moving it from one server 


to another? 


A. File system-related metadata, yes. 
Q. Say again? 


A. File system related metadata, yes, it could. 


Q. And you would agree that moving data from one storage media 


to another can affect the metadata -- I'm sorry -- that moving 


data from one storage media to another can affect metadata? 


og J 


A. I believe that can affect file system metadata. However, 


that's not what I was analyzing in my reports or that I 


testified to today. 


Q. Now, you don't know who originally collected the documents 


you reviewed, do you? 


A. My understanding is, regarding the electronic devices that 


were collected, that your experts from AlixPartners collected 


it. 


Q. You don't know how the documents were stored before they 
reached you? 
A. Ido not. 


Q. You don't know if other people handled these documents 


between the time they were originally created and the time of 


your examination? 
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A. Ido not. 
Q. Do you know whether any of these documents were collected 


es 


by the Australian Taxation Office? 


A. I do not. 


Q. And you don't know that D-E-F-A-U-S means documents seized 
by the ATO and then provided to Dr. Wright's counsel in 
Australia? 

MR. ROCHE: Objection. Relevance. 

THE COURT: Sustained. 
BY MR. RIVERO 


Q. You don't know whether all the documents that you looked at 


that were produced on behalf of Dr. Wright came actually from 


computers that Dr. Wright had, do you? 
A. I do not. 


Q. Now, sir -- and this is important, going back to the 


scientific method -- you have testified that there's certain 


metadata artifacts, whether they be creation dates, 


modification dates, some information within PGP signatures -- 


erent categories of data attached 


— 


you showed us a number of dif 


c: 


to documents. You testified that you believed those documents 


were manipulated, correct? 

A. Yes. 

Q. But you haven't ever tried to replicate the manipulations 
you believe and you opine occurred; isn't that right? 


A. I have not replicated the exact manipulations there, at 
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least in the context of this case, but it's consistent with my 


analysis of other similar documents. 
Q. Other similar documents in other cases? 
A. And in my consulting work. 


Q. Okay. What you're saying is consistent with experience 


that you have. I understand that to be your testimony. Right? 


A. 


Q. But within the case, you never took, for example, a PDF, 
and did those manipulations that you thought had occurred to 


PY a 


see if the results were the same artifacts that you opined are 


manipulations? 
A. Correct. I did not do any specific testing within the 
context of this case. 


Q. You don't know of any studies —- I understand that you're 


testifying from your experience, but you don't know of any 


studies that discuss, consider, or talk about TouchUp Text 


edits as an indicator of manipulations? 


A. I don't. 
Q. You aren't aware of any books that talk about TouchUp Text 


edits as an indicator of modification alteration? 


A. I am not. 


Q. As to certain documents you pointed to manipulation based 


on the idea that the PGP date was wrong -- was off, correct? 
Yes. 


Q. The date for the PGP signature is something that's taken 
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from the computer that was used to create the signature. 


understand that correctly? 
A. 
Q. And you don't know as to any of the documents you looked at 


whether the dates on the device where these documents that 


you're talking about were created whether the time was set 


correctly in any of those devices because you didn't look at 


the devices? 


A. I did not look at the devices. But, for example, in the 


context of forgery number one, we actually have two sources of 


time there. We have the time from the signature and then we 


also have the timestamp from the email produced by Ira Kleiman. 


Both of those timestamps are consistent to at least within an 


— 


hour of each other. 


Q. Sir, as to the first document that you referred to, that 


was produced by Ira Kleiman, right? 


A. I analyzed both a document produced by Ira Kleiman and a 


document, multiple documents, produced by the Defendant. 


Q. As to that document you had access to these devices, didn't 


you? These are Ira Kleiman's devices. They are -—-— I'm sorry. 


I should say those are David Kleiman's devices, Defendant's 


275, 272. There are 14 in all, sir. 


You had access to those devices, didn't you? 


I have never seen those devices before. 


So you don't know that you had access to them? 
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A. No. 
Q. Okay. This is Defendant's 271. Sir, you never looked at 
these devices, at any of these devices? 


A. I wasn't aware those devices existed. 


Q. So you certainly didn't do any study of any of 
devices to see if they bore on your opinion? 
MR. ROCHE: Objection. Outside the scope. 
THE COURT: Sustained. 
BY MR. RIVERO: 
Q. Well, sir, let me ask you, one thing that one could do -- 


in most of these documents, if I remember correctly, that you 


talked about today, were purported emails between David Kleiman 


and Craig Wright; isn't that right? 


A. Some were purportedly between Dave Kleiman and Uyen Nguyen 


as well. 


_ 


Q. But most of them were between actually, David Kleiman 


was in all of them. 


A. Yes, to the best of my recollection. 


Q. Right. And you were asked to determine whether those 
Kleiman emails were manipulated, right? 


A. Yes. 


Q. And you looked at the method and the contents of 
digital documents produced by Dr. Wright, right? 


A. And the cryptographic signatures. 


Q. Okay. But, sir, wouldn't another way to try to figure out 
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if a David Kleiman email were real or not would be to try to 


look at David Kleiman's emails? 


Quite possibly. 


1, let's be clear, sir. If you're trying to figure out 


an email by -- except for those odd circumstances where it's 


from the same person to the same person, by its nature it is 


from one person to another person, generally. You would agree 
with me? 


A. 


Q. And if you were trying to figure out if this email that was 


in Dr. Wright's computer was really real or not, obviously you 


could look at Dr. Wright's emails, and that's what you did, 
right? 


A. Among other things, yes. 


Q. Okay. But isn't another thing you could do is to look at 


the other side, the sender or recipient, not just one side but 


both sides? 


A. Yes. To my recollection, I was able to do searches within 


Relativity, but I don't know the extent to which Dave Kleiman's 


emails were or were not collected. 


Q. All right. So you don't know if whatever Relativity -- 
that's a database. You don't know if the Relativity you were 
looking at was only the Craig Wright side. You don't know 
that? 


A. I don't believe it was only the Craig Wright side. 
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Q. All right. Sir, did you ever ask to look, to see if there 


were any Dave Kleiman devices that might shed light on the 


question of whether there was anything on the Dave Kleiman side 
that proved or disproved your theory that these were not 
authentic emails? 

MR. ROCHE: Objection. Outside the scope. 

THE COURT: Sustained. 


BY MR. RIVERO: 


Q. You stated some documents were manipulated because of 


software versions? 


Inconsistencies with software versions. 


Q. In other words, you said that a certain document was 


created before a software was released? 


A. 


Q. All right. Now, you're aware that software is normally 


tested before it's released to the general public? 


Q. And you don't know whether software that had, in any of 


instances that you talk about -- I think you talked about 
Calibri as a Microsoft font, right? 


A. 


QO. You don't know whether the Microsoft Calibri font was 


circulating on the Internet as an alpha or a beta prior to the 
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time you showed us of the copyright date? 


MR. ROCHE: Objection. Calls for speculation. 


THE COURT: If the witness knows. 


THE WITNESS: I don't know. But the fonts that I 


examined contained cryptographic signatures from Microsoft that 
were dated 2015. 

BY MR. RIVERO: 

Q. Okay. So that would be the final release with the 


copyright that you're showing us, right? 


A. I don't know if it was a final release. All I know is that 


there was a copyright of 2015 and a cryptographic signature 


applied by Microsoft also dated 2015. 


Q. But you don't know if there were alpha or beta versions of 


those prior to that time? 


A. I don't, and I don't believe it makes a difference. 


Q. Now, sir, you say that the time that a document was sent is 


_ 


an indicator of manipulation if it's inconsistent with the 


document, right? 


A. In general, yes. 


But you would agree that the metadata showing time sent 


t necessarily the actual time the email was sent? 


A. Depends on which specific "Date" field you're talking 


about. 


Q. Well, for example, if the user hits "Send" when there was 


no Wi-Fi -- and I don't know if that has happened to you, 
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DY « 


Edman -- and the email went to "Draft" and then later, 


maybe even without your knowledge, it got sent? 


A. 


Q. 


Yes. 


So that's a situation where the time sent isn't necessarily 


the time that the person hit the button to send, right? 


A. 


Q. 


Correct. 


All right. And there's such a thing as a time delay 


feature also for email? 


A. 


Q. 


As far as I know. 


Sir, 


you said you also -- I think when you talk about the 


structure of a document, you're talking in part about a visual 


comparison of certain documents side by side to determine 


whether they're visually identical; isn't that right? 


A. 


Q. 


Okay. 


And you mean they would have the same formatting, 


the same numbers, the same structure, right? 


A. 


Q. 


Yes. 


But, 


for example, you compared these two documents. 


MR. RIVERO: T'll ask Mr. Shah to show D453 for the 


moment to counsel and the witness, and I'll ask if D453 is 


admitted. 


D453. 
I don't believe it is, Your Honor. 
THE COURT: It is not. 


MR. RIVERO: So I'll just show the witness. 
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BY MR. RIVERO: 


Q. Sir, do you remember that you did an analysis of 


document, D453? 


A. Honestly, I don't recall specifically this document. 
Q. Let me show you —- 


MR. RIVERO: If you can, Mr. Shah. We're not showing 


it to the jury yet. D31 
And I believe that's not in evidence. Is that 
correct, not in evidence? 
BY MR. RIVERO: 
Q. Do you remember comparing these two, sir? 
(No verbal response.) 


If you don't, just let me know. 


I don't specifically. 


You don't. Okay. I'll move on, sir. 


Now, to be very clear, when you use the term "forgery" in 


your testimony, what you mean by that, your use of that word, 
regardless of what any of the rest of us think, is a document 


that has been manipulated to appear to be something other than 


what it is, right? 
A. Yes. 


Q. Okay. And you are not opining on the motives or the 


for the alteration of the document, right? 


A. Correct. 


Q. And for that reason you use the word "forgery" to be 
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interchangeable with the words "manipulation," "modification," 


and "alteration," right? 


Yes. 


For you those words are interchangeable? 
Yes. 
Sir, when all this was done you could just as well -- in 


fairness, you could have been shown alteration one, correct, 


instead of the way it was termed here? 


A. I suppose, yes. 


Q. You could have been showed modification four. Would you 


agree with me? 
MR. ROCHE: Objection. Relevance. 


HE COURT: Sustained. 


BY MR. RIVERO: 
Q. Sir, you looked at nine plus -- nine emails and eight 
Bitmessages. 


MR. RIVERO: Pardon me, Judge. Your Honor, I don't 


know if this is an appropriate time for a break because I have 


Bl 


to inquire about my next line of questioning. 


THE COURT: All right. Then, Ladies and Gentlemen, 


let's take a 20-minute recess. 


(Jury not present, 3:23 p.m.) 
THE COURT: All right. We're on a 20-minute recess. 
MR. RIVERO: Thank you. 


(Recess from 3:23 p.m. to 3:40 p.m.) 
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THE COURT: All right. Are we ready to continue? 


MR. RIVERO: Yes, Your Honor. 


THE COURT: On behalf of the Plaintif 


MR. ROCHE: Yes, Your Honor. 


THE COURT: All right. Let's bring in the jury. 
(Before the Jury, 3:42 a.m.) 
THE COURT: All right. Welcome back, Ladies and 


Gentlemen. Please be seated. 


We'll continue with the cross-examination. 


MR. RIVERO: 


Dr. Edman, in terms of things you could have done outside 


fF the digital documents themselves, you could have, for 


example, tried to talk to recipients or senders of some of 


these emails, but you did not do that; isn't that right? 


MR. ROCHE: Objection. Relevance. 
THE COURT: As to what the witness did, overruled. 
THE WITNESS: I mean, I suppose. 


BY MR. RIVERO: 


Q. Well, sir, obviously being that Mr. Kleiman wasn't alive, 


you could have attempted or other people on these emails -- 


and you could have attempted to talk to them to see if they had 


sent or received emails, right? 


A. I mean, I believe in the context of forgeries six and 


seven, to the best of my recollection, those were emails to 


Uyen Nguyen. As far as I know, she was not able to be located. 
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So I don't believe I could have spoken with her. 


QO. So there were more than 40 documents, and there were other 


people on these documents; isn't that true? 


A. I don't recall the sender and recipient of each and every 
one of these documents. 

Q. Some of those documents had handwritten signatures; isn't 
that right? 


A. Yes. I believe so. 


Q. You again determined authenticity based on the metadata, 


but you didn't try to talk to any of the signatories to 


determine whether they acknowledged having signed the 
documents, did you? 
A. No. 


Q. You opined -- my subject matter is, bottom line is, you 


didn't do anything outside of the documents to try to figure 


_ 


out if the facts reflected there happened; isn't that right? 


A. I analyzed the documents and in some instances correlated 


with third-party sources from the Internet, but I didn't 


interview anyone, aside from Jonathan Warren, who I did speak 


to regarding forgery number five. 


Q. You opined that the certificate of registration f 


Panopticrypt was manipulated. 


MR. RIVERO: If we can show the witness and counsel 


Plaintiffs' 34. 
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BY MR. RIVERO: 


Q. Do you recall that you gave expert testimony about this 
document? 
A. I don't specifically remember this document. 


Q. Okay. So let's see if we can show you. 


MR. RIVERO: Defendant Edman's December 
report, at Pages 24 and 25. 


BY MR. RIVERO: 


Q. Okay. Sir, directing your attention to item N, do you see 


the reference to DEFAUS 00521091? 


A. I do. 
Q. All right. 


MR. RIVERO: If you could pull back up, Mr. Shah, 


Plaintiffs -- put side by side, if you would, of the Page 24 


next to Plaintiffs' 34, if you would. 
BY MR. RIVERO: 
Q. All right. Sir, do you see -- I appear to have the wrong 
DEFAUS number. Okay. I'm sorry, sir. 
What I'm now showing you is the fourth page. Do you see 


the coincidence between the DEFAUS numbers? 


A. I do. 


Q. Does that refresh your recollection that you opined on this 


document? 
A. It does. 


MR. RIVERO: All right. Judge, I would move the 
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admission of Plaintiffs' 34. 


MR. ROCHE: Objection. Outside the scope of 


direct testimony. 


HE COURT: Overruled. It will be admitted into 
evidence. 


(Plaintiffs' Exhibit 34 received into evidence.) 


BY MR. RIVERO: 


Q. And to be clear, Mr. Edman, you showed 10 documents, but 


you've opined about more than 40 documents, right? 
A. Yes. 

MR. RIVERO: May we show the jury? 
BY MR. RIVERO: 


£ 


QO. And one of 


the ones you opined on, if we can compare, this 


is your report on December 13, 2019, and it says that you 


looked at DEFAUS 00521091, which is highlighted. 


MR. RIVERO: And then, Mr. Shah, if you would pull up 


the DEFAUS number from Plaintiffs' 34. 


BY MR. RIVERO: 


Q. So definitely one that you opined is not real, right? 


A. Yes. 


MR. ROCHE: Your Honor, the expert report is not in 


evidence. 


THE COURT: The expert report should not be shown to 
the jury. 


MR. RIVERO: Please take that down. 
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All right. Yes. 
BY MR. RIVERO: 


Q. Sir, did you ever -- this is a document that says that it's 


a certificate of registration of a company named Panopticrypt. 


Do you see that? 

A. I do. 

Q. And it says that the date of register was June 20th, 2011, 
right? 


A. 


Q. Did you ever try to or did you ever ask for any search to 


be made of the Australian corporate registration records? 


A. 1 did not. 


Q. And are you aware, sir, that if you had, you would have 


found that the registration was, in fact, submitted on June 19, 


2011 in the registry in Australia? 


MR. ROCHE: Outside the scope. 


Objection. Out the scope. 


THE COURT: Overruled. 


THE WITNESS: I'm not. 


BY MR. RIVERO: 


Q. Sir, would you agree with me that real-life facts could 


tend to either support or contradict the opinions you gave 
based on computer and evidence? 


A. It could, yes. 


Q. Now, you opined that a digital version of 
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university thesis was manipulated, did you not? 
Ay TE gid, 
And you did that, I think, on September 17th, right? 


Tdid. 


Now, sir, that was a university thesis that was done by 


Wright for his LLM at the University of Northumbria. Do 


you remember that? 
A. Ido. 
Q. Now, sir, the thesis, if it was submitted, would be 


submitted to the university; is that right? 


MR. ROCHE: Objection. Foundation. 


HE COURT: Sustained. 


BY MR. RIVERO: 


Q. Well, sir, let me ask you: You have a master's degree, 


correct? 


And you have a doctorate? 

I do. 

And I assume you did a doctoral thesis? 

E: ‘ead. 

And a master's thesis? 

Laid, 

Your theses are submitted to the university, right? 


I guess. I believe I submitted them to my advisor. 


Okay. Sir, did you do anything to go to the University of 
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Northumbria to determine whether the thesis was in fact in the 


registry of the university? 


A. I did not. 
MR. RIVERO: One moment, Judge. 
(Pause in proceedings.) 


BY MR. RIVERO: 


Q. All right, sir. We already talked about Plaintif 


You observed when Ira Kleiman testified about Plaintif 


were you here for Ira Kleiman's testimony? 


A. I was not. 


Q. Okay. Are you aware that the Plaintiff fied that he 


saw no metadata on Plaintiffs' 2? 


MR. ROCHE: Objection. Foundation. 
THE COURT: Sustained. 
(Pause in proceedings.) 


BY MR. RIVERO: 


Q. And, sir, let me go back for a moment to Plaintiffs' 2. 


MR. RIVERO: If we could show that again to the 


as well. 


BY MR. RIVERO: 


Q. Sir, you see that this document reflects an email of 
craig@rcjbr.org? 


A. I do. 


Q. All right. Sir, let me show just the witness and counsel. 


Let me ask you: Are you aware when the domain rcbjr.org was 
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registered? 


A. I don't recall specifically. 


Q. No. And, sir, would you agree with me if it was registered 


at a time later than the date of the email March 12th, 2008, 


_ 


fact that would, based on the way you 


that that would be an arti 


analyzed the other documents -- that would indicate 


manipulation? 
A. I would. 
Q. Let me show you D426. 
MR. RIVERO: Just to counsel and the witness. 
BY MR. RIVERO: 


Q. Sir, are you familiar with ICANN Lookup? 


A. I am. 


Q. And, sir, does this appear to be a result from an ICANN 


Lookup? 


A. It appears to be, but I did not create this document. 


Q. I understand. But is this a tool that one might use to 


determine what is ICANN? 


A. They're an organization that administers domains and IP 


addresses. 


Q. It is the organization that administers domain names? 


A. 


Q. Okay. And so it's a well-known official organization, 
right? 


A. Yes. 
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Right. 


MR. RIVERO: Your Honor, I would move the admission of 


MR. ROCHE: Objection. Foundation. 


THE COURT: Sustained. 


BY MR. RIVERO: 


Q. Sir, are you familiar with what registrations from ICANN 
look like? 
A. Not really. This is not a source that I rely upon. 


Q. Sir, if the create date for the rcejbr.org were November 


2nd, 2011 on an email dated March 12, 2008, you would agree 


with me that that would be consistent with a theory of 


manipulation as you have stated for these other documents? 


MR. ROCHE: Objection. Compound and calls for 
speculation. 

THE COURT: Yes. Let's break that down. 

Sustained. 


BY MR. RIVERO: 


Q. All right. Sir, assume with me that the create date f 


the email address on Plaintiffs' 2 is November 2nd, 2011. 


you understand what I'm asking you to assume? 
A. I believe so. 


QO. Yes. Would that date be after the date of the email 


Plaintiffs' 2? 


lieve so, but, again, I haven't analyzed the email. 
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MR. RIVERO: Could you show Plaintiffs’ 2 to the jury 


and to -- 


BY MR. RIVERO 


All right. That's dated March 12th, 2008, right? 
Yes. 
It's from an address craig@rcjbr.org, right? 


Yes. 


Would you agree with me if the create date for 


craig@rcjbr.org were November 2nd, 2011, that would be an 


artifact indicating some kind of manipulation in the same way 


you said as to these other documents? 


MR. ROCHE: Objection. Asked and answered. 


THE COURT: Overruled. T'll allow it. 


THE WITNESS: I think you are conflating an email 


address and a domain name. But assuming the domain were 


created in November of 2011 and the email were from March 12th, 


2008, then I would consider that an indicator that it has been 


manipulated. 


BY MR. RIVERO: 


Q. Thank you for the correction, sir. 


The domain name is the last part of the email, right? 


A. Yes, sir. 


Q. Okay. All Let me move on. I'd like to show you 


Plaintiffs’ 115. 


MR. RIVERO: And ask that it be shown to counsel. 
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Your Honor, I do not know if this is in evidence. 


THE COURT: It is not in evidence. 


MR. RIVERO: Okay. Then, Judge, I'll move on. 


THE COURT: All right. 


BY MR. RIVERO: 


Q. Sir, you were shown on your direct examination Plaintif 


55. Do you remember that? 


A. You would have to refresh my memory. 


Q. Yep. Will do. 


When you were on the direct examination, Plaintif 


identified to you as number four. Do you remember that? 
A. I do. 
Q. Okay. So let me show you number four, according to what 
counsel did with you this morning. 

MR. RIVERO: And I'll ask that be shown to the jury. 
BY MR. RIVERO: 
Q. Now, you're saying this document is not real, correct? 
A. Correct. 
Q. Now, you understand the statement that's highlighted is one 
that would be purportedly from David Kleiman to Craig Wright 


saying: "As owner of the Bitcoin, we are mining into that," 


referring, I think, to some dormant and untraded company, 


right? 


ROCHE: Objection. Relevance. 


RIVERO: Judge, this is a document that was shown 
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to the witness this morning. 
THE COURT: Overruled. 
BY MR. RIVERO: 
Q. My question, sir, is: You understand the statement in the 


document, as read to you by counsel for Plainti We oboe "We 


only need one dormant and untraded company to sit as an owner 


fF the Bitcoin we are mining into them." Right? 


I see the statement. 


You opined this morning that this document is a forgery, 


right? 
A. I did. 


Q. Let me show you Plaintiffs' 135, which I'm not sure you 


were shown this morning, but we will. 


A. I believe this was forgery three. 


Q. Thank you, sir. Number three. 
Now, this document you say is a false document, right? 


A. It contains a false document. 


Q. Right. In other words, tha F it that's below 


line? 


A. Correct. 


Q. Okay. Now, that's supposed to be a list of Bitcoin, right? 


A. It is a list of Bitcoin addresses. 


Q. And you told the jury that you looked at the list of 
Bitcoin and that you determined that they were real Bitcoin, 


right? 
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MR. ROCHE: Misstates the witness's testimony. 
THE COURT: Overruled. The jury will recall the 
testimony. 


THE WITNESS: I believe I testified that these 


addresses, I looked them up and they had transactions 
associated with them. I didn't do any analysis regarding the 
volume of transactions or how many Bitcoins each address may 
have held at one point. 

BY MR. RIVERO: 

Q. Sir, I may have misheard you this morning. Didn't you say 
that those were Bitcoin public addresses this morning? 


As. 1 did. 


Q. Okay. Now, sir, did you try to look at any of these to 


determine whether they could have belonged to David Kleiman or 


to Craig Wright or whether it was impossible for them to belong 


to David Kleiman or Craig Wright? 


Ps No. 


Q. Isn't it true that there is an address there? 


MR. RIVERO: I'm going to ask Mr. Shah to highlight -—- 


IT believe 1933 is here. Might be on the second page. 


Yeah. Just highlight 1933, if you would, sir. 


BY MR. RIVERO: 


Q. Isn't it true that there is evidence that 1933 would never 


have belonged to either Dr. Wright or to David Kleiman? 


MR. ROCHE: Objection. Outside the scope. 
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THE COURT: The objection is sustained. 


BY MR. RIVERO: 


Q. Do you know one way or another whether there is evidence 
that this -—- 

MR. RIVERO: Judge, he was asked about these addresses 
in direct. 
THE COURT: You may ask another question. 


MR. RIVERO: Okay. Thank you. 


BY MR. RIVERO: 


Q. Do you know one way or another whether there is evidence 
that 1933 could never have belonged to David Kleiman or to 
Craig Wright? 

A. No. I was asked to analyze the document, not the addresses 


contained within them. 


Q. But this document says that some trust holds the following 
keys, right? 

A. (No verbal response.) 

Q. Look at the last line of text. 


MR. ROCHE: The document speaks for itself. 


THE COURT: Overruled. You may refer to it. It's in 


evidence. 


THE WITNESS: It does say that. 


BY MR. RIVERO: 


Q. Okay. So, sir, the question is: You didn't do anything to 


determine whether any of these keys could not have belonged to 
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these gentlemen, right? 
A. No. 


Q. Okay. Now let me show you 546, and I believe we may have 


spoken about 546. Do you recall seeing that one this morning, 
sir? 
A. Yes. This was forgery number one. 


So this was number one. 


So here, sir, do you see that it says -- there's a 


reference to: "Tt is confirmed that I have" -- this is 


supposedly from David Kleiman -- "I have Bitcoin, 320,832.1," 


right? 
A. I see that. 
MR. RIVERO: One moment, Judge. 
(Pause in proceedings.) 


BY MR. RIVERO 


Q. Sir, you're saying this document is 


A. Yes, sir. 


Q. Okay. Now, just before we close, sir, you have studied 


cryptography, correct? 


A. I have. 


A 


Q. And so you are familiar with its principles? 


A. You would have to be more specific. 


Q. Well, for example, you know that private keys are used in 


cryptography? 
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you know that the idea is you're supposed to keep your 


keys private, don't you? 


me show you —- you have had access to the Defendant's 


list; isn't that right? 


lieve I've seen it. 


Q. You had the ability to review any of the documents on -- 


whether or not you were asked to is a different question, but 


I'm asking whether you had the ability to review any of the 
documents that were listed on the exhibit list. Isn't that 
right? 

A. Assuming I had access to whatever documents were listed, I 


suppose so, yes. 


Q. And so were you asked to review any single email 


communication between -- after the March 12 email all the way 


to the end? That's March 12, 2008 all the way past the date of 


the Bitcoin Whitepaper on Halloween 2008. Were you asked to 


look at any single communication between Dr. Kleiman —-- 


Dr. Wright and Mr. Kleiman, David Kleiman, between those dates? 


A. I don't remember the date of each and every single email 


and document I reviewed, but I don't recall any within that 


date. 


Q. Well, you certainly weren't asked to review, we've 
established, the March 12, 2008 email, right? 


A. Right. 
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Q. So let me show you just as an example what is Joint Exhibit 
5o:. 
MR. RIVERO: If we could show it to the jury. And 


this is in evidence. 


If you would, Mr. Shah -- if you would pull out the 
second email where it says: "Craig." 
BY MR. RIVERO: 
Q. Okay. This email, sir, you did not -- 
MR. RIVERO: We need to show that to the jury. It's 
Joint Exhibit 55. 
BY MR. RIVERO: 
Q. You were not asked to and you did not analyze Joint Exhibit 
right? 
A. Correct. I don't recognize this. 


Q. Okay. So you don't recognize this email that says: 


"Craig, how are you? I've been laid up for a bit," and 


continues on, the next-to-the-last sentence: "T have not 


worked in about 10 days, so I have a lot of catching up 1 


You never analyzed that exhibit? 


A. No, not to my recollection. 


Q. And you have no evidence that this document is manipulated 
in any way; isn't that right? 


A. I haven't analyzed it, so no. 


Q. Therefore, you cannot have evidence since you didn't 


analyze it? 
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Correct. 


ll right, sir. There are many, so I will just show a f 


les. 


MR. RIVERO: If we could look at Defendant's 340. 


Also, I believe, Your Honor, in evidence. 


THE COURT: It is in evidence. 


MR. RIVERO: If we could show that to the jury. 
BY MR. RIVERO: 


Q. Sir, this email from Mr. Kleiman to Craig Wright and an 


individual named Shyaam, S-H-Y-A-A-M: "My availability or 


unavailability over the next 10 days, my schedule over the next 


10 days, consider all this includes over 1,500 miles of 


driving," and then it has detail. 


You were never asked to analyze this document; isn't that 
right? 
A. Not that I recall. 


Q. And you have no evidence that this document is manipulated? 


A. Since I haven't analyzed it, no, I have no evidence one way 


or the other. 
MR. RIVERO: Document JEO52. 
BY MR. RIVERO: 
Q. Later, sir -- 
MR. RIVERO: We can show it to the jury. It's a joint 


exhibit. 
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BY MR. RIVERO: 


Q. This is between Mr. Kleiman and Craig Wright. "Subject: 


How are you?" It starts with Dr. Wright writing to Dave 


Kleiman: "How are you? Just checking up and seeing how you 


_ 


are. You've been quiet as of late." 


The response from David Kleiman: "Actually, I had some 


minor surgery. I was in the VA Hospital until February 9 


without my computer. I did see a bunch of emails from you on 


my phone but have not had time to read through them all yet." 


Sir, you were not asked to analyze this Joint Exhibit 52, 


correct? 


A. Not to my recollection. 


Q. And you have no evidence to give that this document is a 


forgery, correct? 


A. Since I haven't analyzed it, I have no evidence one way or 


the other. 


Q. And, sir, there are dozens of emails. Are you aware there 


are dozens of emails between David Kleiman and Craig Wright in 


the period after that March 12th, 2008 email and the end of 


David Kleiman's life? You didn't analyze the vast majority 


those, did you? 


A. I don't know what emails are available from that time 


period. 


Q. Let me ask you, Dr. Edman: You opined that certain 


documents are forgeries, correct? 
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Ae A dads 


Q. Sir, you are telling the jury that those documents are { 


in some way, correct? 


take it you are telling the jury to ignore the 


contents of those documents; is that correct? 
MR. ROCHE: Objection. 
THE COURT: Sustained. 


BY MR. RIVERO: 


Q. Sir, are you telling the jury to believe fake documents? 


MR. ROCHE: Objection. 


THE COURT: Sustained. 


MR. RIVERO: May I have one Your Honor? 


(Pause in proceedings.) 


MR. RIVERO: Your Honor, I have no further questions 


for Dr. Edman. 

THE COURT: All right. Any redirect? 

MR. ROCHE: Yes, Your Honor. One second. 
(Pause in proceedings.) 


REDIRECT EXAMINATION 


BY MR. ROCHE: 
Q. Dr. Edman, good afternoon again. 


You were asked during your testimony whether you were able 


to prove that it was Craig Wright himself who created let's 


go back here -- forgeries number one through five and forgeries 
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